Windows: 7-Zip password-protected archive creation for potential data exfiltration

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of 7-Zip/7za/7zr that use a password argument and an archive creation action. Attackers may compress and encrypt collected data to reduce size and impede inspection prior to exfiltration. It relies on Windows process creation telemetry, matching 7-Zip executable artifacts, command-line password usage, and archive-related command parameters.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Data Collection via Rar Archiving With Recursion and Compression Flags

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Windows: 7-Zip password-protected archive creation for potential data exfiltration

Pivot detection · T1560.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-7-zip-used-to-compress-and-password-protect-data-9fbf5927

title: "Windows: 7-Zip password-protected archive creation for potential data exfiltration"
id: 3d3b2a2f-78be-4912-86f7-b523807dba3e
status: test
description: This rule identifies process executions of 7-Zip/7za/7zr that use a password argument and an archive creation action. Attackers may compress and encrypt collected data to reduce size and impede inspection prior to exfiltration. It relies on Windows process creation telemetry, matching 7-Zip executable artifacts, command-line password usage, and archive-related command parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_7zip_password_compression.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2026-06-05
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Description|contains: 7-Zip
    - Image|endswith:
        - \7z.exe
        - \7zr.exe
        - \7za.exe
    - OriginalFileName:
        - 7z.exe
        - 7za.exe
        - 7zr.exe
  selection_password:
    CommandLine|contains: " -p"
  selection_action:
    CommandLine|contains:
      - " a "
      - " u "
  condition: all of selection_*
falsepositives:
  - Legitimate activity is expected since compressing files with a password is common.
level: medium
license: DRL-1.1
related:
  - id: 9fbf5927-5261-4284-a71d-f681029ea574
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL