ClickFix 7z Password Extraction
Detects command line executions using the 7z compression utility to extract archives with a specific hardcoded password (-pppp). This behavior is an established staging artifact observed in ClickFix campaigns (such as the QuickBooks and Booking.com clusters) to deploy payloads like the NetSupport RAT.
Sigma
