7-Zip Directory Traversal File Creation to Sensitive System Locations
Detects when a 7-Zip process, potentially running from a user directory, writes a file to a sensitive system location. This could indicate a directory traversal attack (e.g., CVE-2025-11001, CVE-2025-11002) where a malicious archive writes a file outside of the intended extraction path. The rule specifically looks for 7-Zip processes initiated from common user-land folders (like Downloads, Desktop, Documents, Temp) creating files in sensitive system directories (like C:\Windows, C:\Windows\System32, C:\ProgramData, or Startup folders), while excluding legitimate installations to Program Files.
Microsoft Sentinel (KQL)
