SigmaHQ/rules/windows/powershell/powershell_data_compressed.yml

title: Data Compressed - Powershell
id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
status: experimental
description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network
author: Timur Zinniatullin, oscd.community
date: 2019/10/21
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml
logsource:
    product: windows
    service: powershell
    definition: 'Script block logging must be enabled'
detection:
    selection:
        EventID: 4104
        keywords|contains|all:
            - '-Recurse'
            - '|'
            - 'Compress-Archive'
    condition: selection
falsepositives:
    - highly likely if archive ops are done via PS
level: low
tags:
    - attack.exfiltration
    - attack.t1560
    - attack.t1002  # an old one
Data Compressed duplciate titles 2019-12-09 16:24:10 +00:00			`title: Data Compressed - Powershell`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`status: experimental`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`author: Timur Zinniatullin, oscd.community`
			`date: 2019/10/21`
			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml`
			`logsource:`
			`product: windows`
			`service: powershell`
Update additional rules to have correct logsource attributes 2020-07-13 21:02:17 +00:00			`definition: 'Script block logging must be enabled'`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`detection:`
			`selection:`
			`EventID: 4104`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`keywords\|contains\|all:`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`- '-Recurse'`
			`- '\|'`
			`- 'Compress-Archive'`
			`condition: selection`
			`falsepositives:`
			`- highly likely if archive ops are done via PS`
			`level: low`
			`tags:`
			`- attack.exfiltration`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1560`
windows/powershell folder reviewed. Old ID’s marked with comment “an old one”. These ID’s have to be removed in future. 2020-08-24 00:01:50 +00:00			`- attack.t1002 # an old one`