Payload reassembly or password-protected archive extraction

Siemphony@siemphonymediumT1140unverified

Matches three Windows utilities being used to turn staged content back into a usable payload, which is the part of AN0767 not already held elsewhere in this corpus: cmd.exe concatenating fragments with `copy /b`, expand.exe pulling a named member out of a cabinet with `-F:`, and an archiver handed a password on the command line with `-p`. The certutil `-decode` and PowerShell `FromBase64String` shapes the analytic lists first are deliberately absent — the T1027.013 rule already selects on exactly those two, and a second copy would add alerts without adding coverage. The `copy /b` leg has a structural limit worth knowing before relying on it: `copy` is a cmd built-in rather than a binary, so it produces a process-creation event only when cmd.exe is started with the command already on its command line, as a dropper or a one-liner does; the same command typed into a console that is already running, or reached from inside a .bat file, creates no process and is invisible here. The `type` command MITRE mentions alongside it is not selectable at all, because the word is far too common in command lines to gate on. The utility and archiver lists populate MITRE's `ToolName` and `FileExtensionFilter` knobs and are authored here, not taken from MITRE; the `TimeWindow` knob that would tie the decode to the download preceding it needs a cross-event join lib/sigma does not model, and the analytic's other two log sources, Sysmon EventID 11 and EventID 10, carry no command line for any of this to be read from. Only the Windows analytic is covered — the Linux and macOS analytics in this strategy are separate log sources and would need their own rules. This rule is written in the Sysmon EventID 1 process_creation vocabulary (`Image`, `CommandLine`), and Sysmon is not present in a default install, so with no agent deployed the rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0275, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cmd.exe" and ProcessCommandLine contains "copy /b") or (FolderPath endswith "\\expand.exe" and (ProcessCommandLine contains "-f:" or ProcessCommandLine contains "/f:" or ProcessCommandLine contains "–f:" or ProcessCommandLine contains "—f:" or ProcessCommandLine contains "―f:")) or ((FolderPath endswith "\\7z.exe" or FolderPath endswith "\\7za.exe" or FolderPath endswith "\\rar.exe" or FolderPath endswith "\\unrar.exe" or FolderPath endswith "\\winrar.exe") and ProcessCommandLine contains " -p"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\cmd.exe" AND CommandLine="*copy /b*") OR (Image="*\\expand.exe" AND (CommandLine="*-f:*" OR CommandLine="*/f:*" OR CommandLine="*–f:*" OR CommandLine="*—f:*" OR CommandLine="*―f:*")) OR ((Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\rar.exe" OR Image="*\\unrar.exe" OR Image="*\\winrar.exe") AND CommandLine="* -p*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" AND TO_LOWER(process.command_line) LIKE "*copy /b*") OR (TO_LOWER(process.executable) LIKE "*\\\\expand.exe" AND (TO_LOWER(process.command_line) LIKE "*-f:*" OR TO_LOWER(process.command_line) LIKE "*/f:*" OR TO_LOWER(process.command_line) LIKE "*–f:*" OR TO_LOWER(process.command_line) LIKE "*—f:*" OR TO_LOWER(process.command_line) LIKE "*―f:*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7za.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\unrar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winrar.exe") AND TO_LOWER(process.command_line) LIKE "* -p*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)copy /b</field>    <description>Payload reassembly or password-protected archive extraction (1/3)</description>    <mitre>      <id>T1140</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\expand\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-f:|/f:|–f:|—f:|―f:)</field>    <description>Payload reassembly or password-protected archive extraction (2/3)</description>    <mitre>      <id>T1140</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\7z\.exe$|\\7za\.exe$|\\rar\.exe$|\\unrar\.exe$|\\winrar\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) -p</field>    <description>Payload reassembly or password-protected archive extraction (3/3)</description>    <mitre>      <id>T1140</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3d94e8c7-3a23-42f9-9601-823eb5512a7e

ATT&CKT1140

T1140Deobfuscate/Decode Files or Information

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

Three Windows utilities turning staged content back into a usable payload: cmd.exe concatenating fragments with copy /b, expand.exe pulling a named member out of a cabinet with -F:, and an archiver handed a password on the command line with -p. That is a deliberate slice of AN0767, not the whole of it. The analytic lists certutil -decode and PowerShell FromBase64String first, and both are absent here because the T1027.013 rule in this corpus already selects on exactly those two — a second copy adds alerts without adding coverage. Only the Windows analytic is covered; the auditd and macOS analytics need their own rules.

02 · Telemetry you need

category: process_creation / product: windows, from AN0767's first log source, written in the Sysmon EventID 1 vocabulary (Image, CommandLine). With no Sysmon agent deployed the rule returns zero rows, which reads as quiet when it means blind. Fed from Security 4688 instead, NewProcessName has to be mapped onto Image first, and the command line exists only when both Audit Process Creation and Include command line in process creation events are enabled — neither is on in a default install or in the MS and CIS baselines.
The analytic's other two sources carry no command line at all: EventID 11 (file_event) and EventID 10 (process_access) cannot express any of this.

03 · How the logic works

Three independent selections, condition: 1 of selection_*. selection_concat pairs Image|endswith: '\cmd.exe' with CommandLine|contains: 'copy /b'. There is a structural limit worth knowing first: copy is a cmd built-in, not a binary, so it produces a process-creation event only when cmd.exe is started with the command already on its line, as a dropper one-liner does. Typed into a console that is already running, or reached from inside a .bat file, it creates no process and is invisible here. The type command MITRE mentions alongside it is not selectable at all — the word is far too common to gate on. selection_expand pairs \expand.exe with CommandLine|contains|windash: '-f:', so -F:, /F: and the Unicode dashes all match. selection_archive_password lists 7z.exe, 7za.exe, rar.exe, unrar.exe and winrar.exe against CommandLine|contains: ' -p'. On attribution: copy, expand and 7zip are MITRE's own ToolName examples, taken as given. The specific archiver binaries and the -p switch are the pipeline's. TimeWindow — tying a decode to the download before it — needs a correlation lib/sigma does not model.

04 · Common false positives

The expand leg dominates. Extracting a single .inf, .sys or .dll from a driver or update cabinet is ordinary servicing work with no attacker-specific shape, and on imaging, build and helpdesk hosts the rule's own first false positive calls it the loudest by a wide margin. Then backup and support tooling passing -p non-interactively so a scheduled job does not block on a prompt, and build scripts using copy /b for its documented purpose.
level: medium asserts more confidence than that first entry supports. Treat low as the honest setting until the expand leg is split out or filtered.

05 · Detection maturity

tier_1: the lowest tier — and it stays there until the rule has been run against real data. Nothing in it has been executed against a log line.
tier_2: is a week of process creation from your own estate: count what share of matches expand contributes, decide whether to split it into its own rule, and confirm the archivers your users actually run are the binaries named here.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

copy /b is one of three spellings cmd accepts. copy/b a+b out.exe and the
Add \7zr.exe and \7zG.exe. Keep winrar.exe, but know it is the windowed
Scope the expand leg by parent. A cabinet extraction under a servicing or

Declared by the author

Driver and update servicing, which is where expand with -F: is normally typed. Extracting a single .inf, .sys or .dll from a Windows Update or vendor driver cabinet is routine work on imaging, build and helpdesk hosts, and on those machines it is the loudest source of matches by a wide margin.
Backup, diagnostics and vendor support tooling that unpacks a password-protected archive non-interactively and therefore has to pass the password with -p so the job does not block on a prompt. Encrypted backup sets and support log bundles are both handled this way on a schedule.
Build and packaging scripts that concatenate files with copy /b — joining cabinet parts, appending a payload to a self-extracting stub, or assembling a firmware image — which is the documented purpose of the flag and long predates its adoption by adversaries.
Helpdesk and end-user extraction of a password-protected archive received by mail or from a supplier portal, when it is done from a command line or a script rather than through the archiver's own window.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Deobfuscate or decode files
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1140, evaluated against their process_creation events.

Share this rule

/u/siemphony/3d94e8c7-3a23-42f9-9601-823eb5512a7e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Payload reassembly or password-protected archive extraction

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it