7-Zip Data Compression and Password Protection for Exfiltration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').