Pay2Key 7za DLL Hijack: Extract powrprof.dll into Avast Directory
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Splunk (SPL)
