Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
1
1
1
Contributors
2
1
1
1
1
Categories
5
4
2
1
1
Platforms
6
Products / Services
2
1
MITRE Techniques
5
5
4
2
1
CVEs
71
71
64
58
49
Detects suspicious child processes spawned by 7-Zip components.
7-Zip Spawns Suspicious Process (LOLBin)
Cortex XDR
Detects a 7-Zip process, the CLI binaries (7z.exe/7za.exe), the GUI worker (7zG.exe), or the File Manager (7zFM.exe) spawning a command interpreter, script host, proxy-execution LOLBin, or download/staging utility as a child. This pattern indicates archive-delivered payload execution, where adversaries use encrypted or password-protected archives to evade mail and AV inspection and the payload runs when the recipient extracts it, as well as scripted CLI abuse for tool execution or exfil staging. Logic is split by parent: the CLI and worker binaries fire unqualified since they have no legitimate reason to spawn these children, while the File Manager requires a suspicious command-line marker to suppress the benign baseline of users double-clicking files inside an archive.
Detects outbound network connections initiated by 7-Zip processes. This could indicate compromise of the 7-Zip application, potentially through exploitation of vulnerabilities like CVE-2026-48095, leading to data exfiltration or command and control communication.
Detects unusual or suspicious child processes spawned by 7-Zip (7z.exe or 7zG.exe). This behavior is indicative of post-exploitation activity following a successful vtable hijack via the CVE-2026-48095 NTFS heap buffer overflow vulnerability.
Detects unusual child processes spawned by 7z.exe or 7zG.exe, which may indicate arbitrary code execution resulting from the CVE-2026-48095 heap buffer overflow. This rule specifically looks for processes initiated by 7-Zip executables, excluding common legitimate child processes like conhost.exe, dllhost.exe, werfault.exe, and 7z.exe itself. The rule can be tuned to be more specific by uncommenting a line to only alert on highly suspicious shells and LOLBINs.
Detects suspicious child processes spawned by 7-Zip components, which could indicate exploitation of a vulnerability (e.g., CVE-2026-48095) or other malicious activity. The rule specifically looks for common scripting and command-line interpreters being launched by 7-Zip executables.