Detection: Suspicious Process Executed From Container File

Updated Date: 2026-07-09 ID: d8120352-3b62-411c-8cb6-7b47584dd5e8 Author: Steven Dick Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common technique used by adversaries to execute scripts or evade defenses. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.

Search

  1
  2| tstats `security_content_summariesonly`
  3count
  4min(_time) as firstTime
  5max(_time) as lastTime
  6from datamodel=Endpoint.Processes
  7where Processes.process IN (
  8    "*.ZIP\\*",
  9    "*.ISO\\*",
 10    "*.IMG\\*",
 11    "*.CAB\\*",
 12    "*.TAR\\*",
 13    "*.GZ\\*",
 14    "*.RAR\\*",
 15    "*.7Z\\*"
 16    )
 17    AND Processes.action="allowed"
 18by
 19    Processes.action
 20    Processes.dest
 21    Processes.original_file_name
 22    Processes.parent_process
 23    Processes.parent_process_exec
 24    Processes.parent_process_guid
 25    Processes.parent_process_id
 26    Processes.parent_process_name
 27    Processes.parent_process_path
 28    Processes.process
 29    Processes.process_exec
 30    Processes.process_guid
 31    Processes.process_hash
 32    Processes.process_id
 33    Processes.process_integrity_level
 34    Processes.process_name
 35    Processes.process_path
 36    Processes.user
 37    Processes.user_id
 38    Processes.vendor_product
 39
 40| `drop_dm_object_name(Processes)`
 41
 42| regex process="(?i).*\.(zip
 43|iso
 44|img
 45|cab
 46|tar
 47|gz
 48|rar
 49|7z)\\\\.+\.(bat
 50|bin
 51|cab
 52|cmd
 53|com
 54|cpl
 55|ex_
 56|exe
 57|gadget
 58|inf1
 59|ins
 60|inx
 61|htm
 62|html
 63|isu
 64|jar
 65|job
 66|js
 67|jse
 68|lnk
 69|msc
 70|msi
 71|msp
 72|mst
 73|paf
 74|pif
 75|ps1
 76|reg
 77|rgs
 78|scr
 79|sct
 80|shb
 81|shs
 82|u3p
 83|vb
 84|vbe
 85|vbs
 86|vbscript
 87|ws
 88|wsf
 89|wsh)\"?$"
 90
 91| rex field=process "(?i).+\\\\(?<file_name>[^\\\\]+\.(?:zip
 92|iso
 93|img
 94|cab
 95|tar
 96|gz
 97|rar
 98|7z))\\\\(?:.+\\\\)?(?<container_file_name>[^\\\\\"]+\.(?:bat
 99|bin
100|cab
101|cmd
102|com
103|cpl
104|ex_
105|exe
106|gadget
107|inf1
108|ins
109|inx
110|htm
111|html
112|isu
113|jar
114|job
115|js
116|jse
117|lnk
118|msc
119|msi
120|msp
121|mst
122|paf
123|pif
124|ps1
125|reg
126|rgs
127|scr
128|sct
129|shb
130|shs
131|u3p
132|vb
133|vbe
134|vbs
135|vbscript
136|ws
137|wsf
138|wsh))\"?$"
139
140| `security_content_ctime(firstTime)`
141
142| `security_content_ctime(lastTime)`
143
144| `suspicious_process_executed_from_container_file_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`
Windows Event Log Security 4688	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`
CrowdStrike ProcessRollup2	Other	`'crowdstrike:events:sensor'`	`'crowdstrike'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
suspicious_process_executed_from_container_file_filter	`search *`

suspicious_process_executed_from_container_file_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1036.008	Masquerade File Type	Stealth
T1204.002	Malicious File	Execution

Installation

Exploitation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	Yes

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Various business process or userland applications and behavior.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$].	user	user	50

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$].	dest	system	50

Threat Objects

Field	Type
container_file_name	file_name
file_name	file_name
process_name	process_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 12