ROMULUS Route B PowerShell 7zr passworded nested 7z extraction chain

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•4

Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.