Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
