Password Protected Compressed File Extraction Via 7Zip

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the use of 7-Zip utilities (7z.exe, 7za.exe, and 7zr.exe) to extract password-protected compressed files. This activity can be indicative of an adversary decompressing sensitive data or malware that was archived with a password, potentially as part of collection or staging activities.