Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Flags 7-Zip (7z/7za/7zr) command lines that include -p with x extraction and -o output, indicating password-protected archive extraction.

FreeReviewedSigma · Low · v5

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-03-10
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions of 7-Zip (7z.exe, 7za.exe, or 7zr.exe) where the command line contains patterns consistent with extracting a password-protected archive (includes " -p", " x ", and " -o"). Attackers may use compressed archives with passwords to evade casual inspection while still staging or deploying files after extraction. The detection relies on Windows process creation telemetry fields including the executable image/filename and the full command line.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Data Staging via WinRAR Recursive Archive with Silent Update Flags (via process_creation)

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

Suspicious 7za Archiver Executed from Windows Temp

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

Suspicious Multi-Volume RAR Archiving for Collection by EAGERBEE

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Pivot detection · T1560.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-7-zip-extraction-of-password-protected-archives-using-p-b717b8fd

title: Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr
id: 0da3eab4-b114-485f-ab90-1f572c02e169
status: test
description: This rule flags Windows process executions of 7-Zip (7z.exe, 7za.exe, or 7zr.exe) where the command line contains patterns consistent with extracting a password-protected archive (includes " -p", " x ", and " -o"). Attackers may use compressed archives with passwords to evade casual inspection while still staging or deploying files after extraction. The detection relies on Windows process creation telemetry fields including the executable image/filename and the full command line.
references:
  - https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_7zip_password_extraction.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-10
modified: 2026-06-05
tags:
  - attack.collection
  - attack.t1560.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Description|contains: 7-Zip
    - Image|endswith:
        - \7z.exe
        - \7za.exe
        - \7zr.exe
    - OriginalFileName:
        - 7z.exe
        - 7za.exe
        - 7zr.exe
  selection_password:
    CommandLine|contains|all:
      - " -p"
      - " x "
      - " -o"
  condition: all of selection_*
falsepositives:
  - Legitimate activity is expected since extracting files with a password can be common in some environment.
level: low
license: DRL-1.1
related:
  - id: b717b8fd-6467-4d7d-b3d3-27f9a463af77
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL