AD Snapshot Is Compressed with 7zr

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•11

Detects the use of 7-Zip (7zr.exe) to compress Active Directory snapshot files (result.dat or snapshot) into an archive with a specific compression level (-mx=5). This activity could indicate an adversary staging data for exfiltration.