Extracting FIles (e.g. SAM and SYSTEM) With 7-Zip
This is about the article "Attacking SAM and Extracting Hashes With 7z" from Hackers Arise: https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/ This query detects instances of 7-Zip executing with elevated administrator privileges on Windows endpoints while filtering out routine background noise. It begins by capturing both live and backfilled process creation telemetry (ProcessRollup2 and SyntheticProcessRollup2) and uses a case-insensitive regular expression to identify any standard 7-Zip executable, including the command-line, GUI, and file manager binaries (7z.exe, 7za.exe, 7zg.exe, or 7zFM.exe). To pinpoint administrative activity, it filters exclusively for processes with a high integrity level decimal of 12288, indicating the binary was elevated via UAC ("Run as administrator"). It then reduces false positives by excluding automated service accounts ending in svc, Active Directory machine accounts ending in $, and the built-in SYSTEM identity. Finally, it formats the remaining high-fidelity events into a structured table displaying the timestamp, executable path, username, integrity level, and full command-line arguments for quick triage.
CQL
