Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Flags 7-Zip (7z/7za/7zr) command lines that include -p with x extraction and -o output, indicating password-protected archive extraction.

FreeReviewedSigma · Low · v5

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-03-10
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions of 7-Zip (7z.exe, 7za.exe, or 7zr.exe) where the command line contains patterns consistent with extracting a password-protected archive (includes " -p", " x ", and " -o"). Attackers may use compressed archives with passwords to evade casual inspection while still staging or deploying files after extraction. The detection relies on Windows process creation telemetry fields including the executable image/filename and the full command line.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Pivot detection · T1560.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-7-zip-extraction-of-password-protected-archives-using-p-b717b8fd

title: Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr
id: 0da3eab4-b114-485f-ab90-1f572c02e169
status: test
description: This rule flags Windows process executions of 7-Zip (7z.exe, 7za.exe, or 7zr.exe) where the command line contains patterns consistent with extracting a password-protected archive (includes " -p", " x ", and " -o"). Attackers may use compressed archives with passwords to evade casual inspection while still staging or deploying files after extraction. The detection relies on Windows process creation telemetry fields including the executable image/filename and the full command line.
references:
  - https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_7zip_password_extraction.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-10
modified: 2026-06-05
tags:
  - attack.collection
  - attack.t1560.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Description|contains: 7-Zip
    - Image|endswith:
        - \7z.exe
        - \7za.exe
        - \7zr.exe
    - OriginalFileName:
        - 7z.exe
        - 7za.exe
        - 7zr.exe
  selection_password:
    CommandLine|contains|all:
      - " -p"
      - " x "
      - " -o"
  condition: all of selection_*
falsepositives:
  - Legitimate activity is expected since extracting files with a password can be common in some environment.
level: low
license: DRL-1.1
related:
  - id: b717b8fd-6467-4d7d-b3d3-27f9a463af77
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL