add process_creation_susp_winzip.yml

rules/windows/process_creation/process_creation_susp_winzip.yml

@@ -0,0 +1,30 @@
+title: Compress Data and Lock With Password for Exfiltration With WINZIP
+id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
+status: experimental
+author: frack113
+date: 
+description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
+tags:
+    - attack.collection
+    - attack.t1560.001
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_winzip:
+        CommandLine|contains:
+            - 'winzip.exe'
+            - 'winzip64.exe'
+    selection_password:
+        CommandLine|contains:
+            - '-s"'
+    selection_other:
+        CommandLine|contains:
+            - ' -min '
+            - ' -a '
+    condition: all of them 
+falsepositives:
+    - Unknown
+level: medium