Detect 7-Zip Suspicious Child Process
Detects suspicious child processes spawned by 7-Zip components, which could indicate exploitation of a vulnerability (e.g., CVE-2026-48095) or other malicious activity. The rule specifically looks for common scripting and command-line interpreters being launched by 7-Zip executables.
Microsoft Sentinel (KQL)
