7-Zip Spawns Suspicious Process (LOLBin)
Detects a 7-Zip process, the CLI binaries (7z.exe/7za.exe), the GUI worker (7zG.exe), or the File Manager (7zFM.exe) spawning a command interpreter, script host, proxy-execution LOLBin, or download/staging utility as a child. This pattern indicates archive-delivered payload execution, where adversaries use encrypted or password-protected archives to evade mail and AV inspection and the payload runs when the recipient extracts it, as well as scripted CLI abuse for tool execution or exfil staging. Logic is split by parent: the CLI and worker binaries fire unqualified since they have no legitimate reason to spawn these children, while the File Manager requires a suspicious command-line marker to suppress the benign baseline of users double-clicking files inside an archive.
Cortex XDR
