Suspicious Process Spawning from 7-Zip Utility

Detects instances where 7-Zip utility processes (7z.exe, 7zFM.exe, 7zG.exe) or DLLs act as the parent for suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or other binaries running from temporary or download directories. This pattern is commonly associated with the execution of malicious payloads extracted or staged via 7-Zip archives.