Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining
Flags Windows process creation chaining 7z archive commands with .zip plus .txt/.log extensions and wscript+rundll32 context.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-01-22
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows process creation command lines where 7z is used to create password-protected archives containing specific file extensions, combined with execution chaining involving wscript/vbs and rundll32.dll patterns. Such chaining can indicate staged payload packaging followed by scripted execution and DLL loading through rundll32, a technique often used to reduce direct visibility of the payload’s final execution. Telemetry required includes process creation events with command line, parent image, parent command line, and process image details.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining"
id: 0f65401e-2c20-4ec3-a698-53de0e89b68a
status: test
description: This rule matches Windows process creation command lines where 7z is used to create password-protected archives containing specific file extensions, combined with execution chaining involving wscript/vbs and rundll32.dll patterns. Such chaining can indicate staged payload packaging followed by scripted execution and DLL loading through rundll32, a technique often used to reduce direct visibility of the payload’s final execution. Telemetry required includes process creation events with command line, parent image, parent command line, and process image details.
references:
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-22
modified: 2024-09-12
tags:
- attack.execution
- attack.t1059.001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_generic_1:
CommandLine|contains:
- 7z.exe a -v500m -mx9 -r0 -p
- 7z.exe a -mx9 -r0 -p
CommandLine|contains|all:
- .zip
- .txt
selection_generic_2:
CommandLine|contains:
- 7z.exe a -v500m -mx9 -r0 -p
- 7z.exe a -mx9 -r0 -p
CommandLine|contains|all:
- .zip
- .log
selection_generic_3:
ParentCommandLine|contains|all:
- wscript.exe
- .vbs
CommandLine|contains|all:
- rundll32.exe
- C:\Windows
- .dll,Tk_
selection_generic_4:
ParentImage|endswith: \rundll32.exe
ParentCommandLine|contains|all:
- C:\Windows
- .dll
CommandLine|contains: "cmd.exe /C "
selection_generic_5:
ParentImage|endswith: \rundll32.exe
Image|endswith: \dllhost.exe
CommandLine: ""
condition: 1 of selection_generic_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f
type: derived