Windows Process: 7-Zip Used to Compress and Password-Protect Data

title: "Windows Process: 7-Zip Used to Compress and Password-Protect Data"
id: 3d3b2a2f-78be-4912-86f7-b523807dba3e
status: test
description: This rule identifies Windows process executions of 7-Zip (7z.exe/7za.exe/7zr.exe) where the command line includes a password flag and uses archive creation actions. Attackers commonly compress and password-protect data to reduce size, increase transfer efficiency, and hinder casual inspection before exfiltration. Telemetry relies on Windows process creation fields including executable name/path, file description, and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_7zip_password_compression.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2026-06-05
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Description|contains: 7-Zip
    - Image|endswith:
        - \7z.exe
        - \7zr.exe
        - \7za.exe
    - OriginalFileName:
        - 7z.exe
        - 7za.exe
        - 7zr.exe
  selection_password:
    CommandLine|contains: " -p"
  selection_action:
    CommandLine|contains:
      - " a "
      - " u "
  condition: all of selection_*
falsepositives:
  - Legitimate activity is expected since compressing files with a password is common.
level: medium
license: DRL-1.1
related:
  - id: 9fbf5927-5261-4284-a71d-f681029ea574
    type: derived