Suspicious 7-Zip Child Process (CVE-2026-48095)
Detects unusual child processes spawned by 7z.exe or 7zG.exe, which may indicate arbitrary code execution resulting from the CVE-2026-48095 heap buffer overflow. This rule specifically looks for processes initiated by 7-Zip executables, excluding common legitimate child processes like conhost.exe, dllhost.exe, werfault.exe, and 7z.exe itself. The rule can be tuned to be more specific by uncommenting a line to only alert on highly suspicious shells and LOLBINs.
Microsoft Sentinel (KQL)
