← Back to SOC feed Coverage →

Password Protected Archive Creation

kql MEDIUM Azure-Sentinel
DeviceProcessEvents
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-21T11:00:00Z · Confidence: medium

Hunt Hypothesis

Attackers may create password-protected archives to exfiltrate sensitive data, masking malicious activity and evading basic detection mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential data exfiltration attempts and disrupt adversary operations.

KQL Query

DeviceProcessEvents
| where ProcessCommandLine matches regex @"\s[aukfAUKF]\s.*\s-p"  // Basic filter to look for launch string
| extend SplitLaunchString = split(ProcessCommandLine, ' ') // Split on the space
| where array_length(SplitLaunchString) >= 5 and SplitLaunchString[1] in~ ('a','u','k','f') // look for calls to archive or update an archive specifically as the first argument
| mv-expand SplitLaunchString // cross apply the array
| where SplitLaunchString startswith "-p"  // -p is the password switch and is immediately followed by a password without a space
| extend ArchivePassword = substring(SplitLaunchString, 2, strlen(SplitLaunchString))
| project-reorder ProcessCommandLine, ArchivePassword // Promote these fields to the left

Analytic Rule Definition

id: 8ec6abaa-de36-4510-86c2-1a1aeeb004ab
name: Password Protected Archive Creation
description: |
  One common technique leveraged by attackers is using archiving applications to package up files for exfiltration. In many cases, these archives are usually protected with a password to make analysis more difficult.  This query identifies applications which leverage a command line pattern which matches the 7zip and WinRAR command line executables to create or update an archive when a password is specified.  By detecting based on the command line we can avert attempts to dodge detection by renaming the application.
  Happy hunting!
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Collection
- Exfiltration
query: |
  DeviceProcessEvents
  | where ProcessCommandLine matches regex @"\s[aukfAUKF]\s.*\s-p"  // Basic filter to look for launch string
  | extend SplitLaunchString = split(ProcessCommandLine, ' ') // Split on the space
  | where array_length(SplitLaunchString) >= 5 and SplitLaunchString[1] in~ ('a','u','k','f') // look for calls to archive or update an archive specifically as the first argument
  | mv-expand SplitLaunchString // cross apply the array
  | where SplitLaunchString startswith "-p"  // -p is the password switch and is immediately followed by a password without a space
  | extend ArchivePassword = substring(SplitLaunchString, 2, strlen(SplitLaunchString))
  | project-reorder ProcessCommandLine, ArchivePassword // Promote these fields to the left

Required Data Sources

Sentinel TableNotes
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Exfiltration/Password Protected Archive Creation.yaml