7zip or WinRAR Used to Archive Stolen Data

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.