7Zip Compressing Dump Files

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the execution of 7-Zip (7z.exe, 7za.exe, 7zr.exe) to compress files with extensions like '.dmp', '.dump', or '.hdmp'. This activity is often a precursor to data exfiltration, where memory dump files or other sensitive data are compressed for easier transfer.