Windows Process Creation: 7-Zip Compressing .dmp/.dump Files

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags Windows executions of 7-Zip (7z.exe/7za.exe/7zr.exe) where the command line contains .dmp, .dump, or .hdmp. Attackers may compress memory dump or dump files to package them for easier staging or exfiltration. It relies on process creation telemetry including the executable image name and command line arguments.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Windows Process Creation: 7-Zip Compressing .dmp/.dump Files

Pivot detection · T1560.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-7-zip-compressing-dmp-dump-files-ec570e53

title: "Windows Process Creation: 7-Zip Compressing .dmp/.dump Files"
id: df54134f-64b8-40fa-8834-32af0605bbec
related:
  - id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
    type: derived
  - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7
    type: derived
status: test
description: This rule flags Windows executions of 7-Zip (7z.exe/7za.exe/7zr.exe) where the command line contains .dmp, .dump, or .hdmp. Attackers may compress memory dump or dump files to package them for easier staging or exfiltration. It relies on process creation telemetry including the executable image name and command line arguments.
references:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-27
modified: 2026-06-05
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Description|contains: 7-Zip
    - Image|endswith:
        - \7z.exe
        - \7zr.exe
        - \7za.exe
    - OriginalFileName:
        - 7z.exe
        - 7za.exe
        - 7zr.exe
  selection_extension:
    CommandLine|contains:
      - .dmp
      - .dump
      - .hdmp
  condition: all of selection_*
falsepositives:
  - Legitimate use of 7z with a command line in which ".dmp" or ".dump" appears accidentally
  - Legitimate use of 7z to compress WER ".dmp" files for troubleshooting
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL