PowerShell/cmd launched 7zr password extraction followed by execution from extra

Renata Cardoso@rcardososec

•updated 4 days ago•2•0•5

Detects 7zr.exe, 7z.exe, or 7za.exe launched by a shell process (PowerShell, Cmd) using a password extraction switch (-p) and output directory, followed within 10 minutes by the execution of a new binary from within that user-writable extraction directory.