# RAR file download from the internet **URL:** \ **Category:** Endpoint Security\ **Created:** [March 6, 2023, 12:10pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072 "2023-03-06T12:10:50Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Maretti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maretti/32/118976_2.png) [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Post date:** [March 6, 2023, 12:10pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072/1 "2023-03-06T12:10:50Z")
I tried this rule since a lot of malware is spread using password protected RAR files [Roshal Archive (RAR) or PowerShell File Downloaded from the Internet | Elastic Security Solution [7.17] | Elastic](https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-14-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.html) The Query the rule uses: ```python event.category:(network or network_traffic) and network.protocol:http and (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or 192.0.2.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or 192.168.0.0/16 or 192.88.99.0/24 or 224.0.0.0/4 or 100.64.0.0/10 or 192.175.48.0/24 or 198.18.0.0/15 or 198.51.100.0/24 or 203.0.113.0/24 or 240.0.0.0/4 or "::1" or "FE80::/10" or "FF00::/8" ) and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) ``` I wrote 2 scripts 1 in Python and 1 in PowerShell both cases give no alert ```python import requests url = 'https://getsamplefiles.com/download/rar/sample-1.rar' filename = 'file.rar' response = requests.get(url) with open(filename, 'wb') as f: f.write(response.content) print('Download complete!') ``` ```python $url = 'https://getsamplefiles.com/download/rar/sample-1.rar' $outputFile = 'file.rar' Invoke-WebRequest -Uri $url -OutFile $outputFile Write-Host 'Download complete!' ``` I also tried downloading a rar file with a browser (Opera GX) but this isn't logged aswell `url.extension` is not an available field, the rule filters on this to see if the url is a RAR file ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e962fc3fa3227bd971950b0393751e29087e164b.png) I use the system, windows and defense integrations Any ideas why the network traffic from the scripts or browser isn't logged? ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [March 20, 2023, 2:44pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072/2 "2023-03-20T14:44:56Z")
Hi @Maretti. Thanks for reaching out. In order to execute, those files must be extracted from the archive, written to disk, then opened by their respective applications. Endpoint scans supported file types when they are written and/or opened. Endpoint doesn't attempt to scan compressed archives because the performance overhead can be significant, and efficacy is limited because trivial bypasses via password encryption are ubiquitous these days. Endpoint doesn't intercept/[MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) TLS connections (HTTPS) either. It provides IP-level reporting for such connections. For HTTPS connections, the URL is transmitted inside the encrypted stream. The encryption is performed inside the user-mode application, and its contents are not visible to our kernel driver. That rule mentions HTTP - have you tried the same download without TLS? Regards, Gabriel ---
**Author:** ![Maretti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maretti/32/118976_2.png) [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Post date:** [March 23, 2023, 10:04am UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072/3 "2023-03-23T10:04:25Z")
Hi @gabriel.landau Thanks for the response I tried without TLS and it still isn't present in the logs Regards, Maretti ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [March 23, 2023, 3:17pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072/4 "2023-03-23T15:17:31Z")
Thanks for the update. I just spoke with the engineer who wrote it and got clarification on the Defend/Endpoint side - I misunderstood it. PacketBeat will get you the data you want. Add the "Network Packet Capture" integration to Agent. ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5cbab88ad11bf87ff1ba745089c5d10f86adec52.png) Example: ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a295887bd9cd9d632451951e30c303d76724226.png) Sample data: ```json { "method": "GET", "query": "GET /download/rar/sample-1.rar", "destination": { "port": 80, "bytes": 414, "ip": "68.183.46.179", "domain": "getsamplefiles.com" }, "source": { "port": 50871, "bytes": 188, "ip": "192.168.1.23" }, "type": "http", "url": { "path": "/download/rar/sample-1.rar", "extension": "rar", "scheme": "http", "domain": "getsamplefiles.com", "full": "http://getsamplefiles.com/download/rar/sample-1.rar" }, "network": { "community_id": "1:FT5uqa2sUJPH1NjlQpGMezJPlDM=", "protocol": "http", "bytes": 602, "transport": "tcp", "type": "ipv4", "direction": "egress" } } ``` Regards, Gabriel ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 20, 2023, 3:18pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072/5 "2023-04-20T15:18:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.