Potential RipZip Attack on Startup Folder

Hunt Hypothesis

Adversaries may be using RipZip to deploy malicious shortcuts via a phishing attack by expanding a ZIP file in the startup folder. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential lateral movement and persistence tactics.

Detection Rule

Sigma (Original)

title: Potential RipZip Attack on Startup Folder
id: a6976974-ea6f-4e97-818e-ea08625c52cb
status: test
description: |
    Detects a phishing attack which expands a ZIP file containing a malicious shortcut.
    If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.
    Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
references:
    - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
author: Greg (rule)
date: 2022-07-21
modified: 2023-01-05
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547
logsource:
    category: file_event
    product: windows
detection:
    selection: # %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\target.lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}\target.lnk
        TargetFilename|contains|all:
            - '\Microsoft\Windows\Start Menu\Programs\Startup'
            - '.lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}'
        Image|endswith: '\explorer.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imFileEvent
| where (TargetFileName contains "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" and TargetFileName contains ".lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}") and TargetFilePath endswith "\\explorer.exe"

False Positive Guidance

• Scenario: Legitimate Software Installation via ZIP
  Description: A system administrator or user expands a ZIP file containing legitimate software (e.g., Adobe Reader, Java Runtime) via the Windows Explorer process.
  Filter/Exclusion: Exclude ZIP files from known trusted vendors (e.g., file.name contains "Adobe" or "Java") or use a whitelist of allowed ZIP file paths (e.g., process.directory contains "C:\Program Files").

• Scenario: Scheduled Job Expands ZIP File
  Description: A scheduled task or service (e.g., Task Scheduler, Windows Update) expands a ZIP file as part of a legitimate system maintenance or update process.
  Filter/Exclusion: Exclude processes associated with scheduled tasks (e.g., process.name contains "schtasks.exe" or process.name contains "wuauclt.exe") or filter by known update directories (e.g., process.directory contains "C:\Windows\SoftwareDistribution").

• Scenario: Admin Tool or Script Expands ZIP File
  Description: An administrator uses a script or tool (e.g., PowerShell, 7-Zip, WinRAR) to expand a ZIP file for configuration or deployment purposes.
  Filter/Exclusion: Exclude processes associated with administrative tools (e.g., process.name contains "powershell.exe" or process.name contains "7z.exe") or filter by known admin directories (e.g., process.directory contains "C:\Windows\System32").

• Scenario: User Downloads and Expands ZIP File via Explorer
  Description: A user downloads a ZIP file from a legitimate source (e.g., company intranet, internal repository) and expands it using Windows Explorer.
  Filter/Exclusion: Exclude ZIP files from internal domains (e.g., `file.hash contains “internal-repo-hash

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Tactic: Persistence
• Technique: T1547