Payload reassembly or password-protected archive extraction

1title: Payload reassembly or password-protected archive extraction2id: 3d94e8c7-3a23-42f9-9601-823eb5512a7e3status: experimental4description: |5  Matches three Windows utilities being used to turn staged content back into a6  usable payload, which is the part of AN0767 not already held elsewhere in7  this corpus: cmd.exe concatenating fragments with `copy /b`, expand.exe8  pulling a named member out of a cabinet with `-F:`, and an archiver handed a9  password on the command line with `-p`. The certutil `-decode` and PowerShell10  `FromBase64String` shapes the analytic lists first are deliberately absent —11  the T1027.013 rule already selects on exactly those two, and a second copy12  would add alerts without adding coverage. The `copy /b` leg has a structural13  limit worth knowing before relying on it: `copy` is a cmd built-in rather14  than a binary, so it produces a process-creation event only when cmd.exe is15  started with the command already on its command line, as a dropper or a16  one-liner does; the same command typed into a console that is already17  running, or reached from inside a .bat file, creates no process and is18  invisible here. The `type` command MITRE mentions alongside it is not19  selectable at all, because the word is far too common in command lines to20  gate on. The utility and archiver lists populate MITRE's `ToolName` and21  `FileExtensionFilter` knobs and are authored here, not taken from MITRE; the22  `TimeWindow` knob that would tie the decode to the download preceding it23  needs a cross-event join lib/sigma does not model, and the analytic's other24  two log sources, Sysmon EventID 11 and EventID 10, carry no command line for25  any of this to be read from. Only the Windows analytic is covered — the Linux26  and macOS analytics in this strategy are separate log sources and would need27  their own rules. This rule is written in the Sysmon EventID 128  process_creation vocabulary (`Image`, `CommandLine`), and Sysmon is not29  present in a default install, so with no agent deployed the rule returns zero30  rows, which reads as quiet when it means blind.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0275, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T114034  - https://attack.mitre.org/detectionstrategies/DET027535author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.defense-evasion39  - attack.t114040logsource:41  category: process_creation42  product: windows43detection:44  selection_concat:45    Image|endswith: '\cmd.exe'46    CommandLine|contains: 'copy /b'47  selection_expand:48    Image|endswith: '\expand.exe'49    CommandLine|contains|windash: '-f:'50  selection_archive_password:51    Image|endswith:52      - '\7z.exe'53      - '\7za.exe'54      - '\rar.exe'55      - '\unrar.exe'56      - '\winrar.exe'57    CommandLine|contains: ' -p'58  condition: 1 of selection_*59falsepositives:60  - "Driver and update servicing, which is where expand with -F: is normally typed. Extracting a single .inf, .sys or .dll from a Windows Update or vendor driver cabinet is routine work on imaging, build and helpdesk hosts, and on those machines it is the loudest source of matches by a wide margin."61  - "Backup, diagnostics and vendor support tooling that unpacks a password-protected archive non-interactively and therefore has to pass the password with -p so the job does not block on a prompt. Encrypted backup sets and support log bundles are both handled this way on a schedule."62  - "Build and packaging scripts that concatenate files with copy /b — joining cabinet parts, appending a payload to a self-extracting stub, or assembling a firmware image — which is the documented purpose of the flag and long predates its adoption by adversaries."63  - "Helpdesk and end-user extraction of a password-protected archive received by mail or from a supplier portal, when it is done from a command line or a script rather than through the archiver's own window."64level: medium