Suspicious 7-Zip Child Process (CVE-2026-48095)
Detects unusual or suspicious child processes spawned by 7-Zip (7z.exe or 7zG.exe). This behavior is indicative of post-exploitation activity following a successful vtable hijack via the CVE-2026-48095 NTFS heap buffer overflow vulnerability.
Sigma
