Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining

Flags Windows process creation chaining 7z archive commands with .zip plus .txt/.log extensions and wscript+rundll32 context.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-01-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation command lines where 7z is used to create password-protected archives containing specific file extensions, combined with execution chaining involving wscript/vbs and rundll32.dll patterns. Such chaining can indicate staged payload packaging followed by scripted execution and DLL loading through rundll32, a technique often used to reduce direct visibility of the payload’s final execution. Telemetry required includes process creation events with command line, parent image, parent command line, and process image details.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Node.js Spawning Script Interpreter for Dropped Payload

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Suspicious PowerShell Spawned by cscript in Script Chain

Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-7z-archive-with-specific-extensions-via-wscript-and-run-9be34ad0

title: "Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining"
id: 0f65401e-2c20-4ec3-a698-53de0e89b68a
status: test
description: This rule matches Windows process creation command lines where 7z is used to create password-protected archives containing specific file extensions, combined with execution chaining involving wscript/vbs and rundll32.dll patterns. Such chaining can indicate staged payload packaging followed by scripted execution and DLL loading through rundll32, a technique often used to reduce direct visibility of the payload’s final execution. Telemetry required includes process creation events with command line, parent image, parent command line, and process image details.
references:
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-22
modified: 2024-09-12
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_generic_1:
    CommandLine|contains:
      - 7z.exe a -v500m -mx9 -r0 -p
      - 7z.exe a -mx9 -r0 -p
    CommandLine|contains|all:
      - .zip
      - .txt
  selection_generic_2:
    CommandLine|contains:
      - 7z.exe a -v500m -mx9 -r0 -p
      - 7z.exe a -mx9 -r0 -p
    CommandLine|contains|all:
      - .zip
      - .log
  selection_generic_3:
    ParentCommandLine|contains|all:
      - wscript.exe
      - .vbs
    CommandLine|contains|all:
      - rundll32.exe
      - C:\Windows
      - .dll,Tk_
  selection_generic_4:
    ParentImage|endswith: \rundll32.exe
    ParentCommandLine|contains|all:
      - C:\Windows
      - .dll
    CommandLine|contains: "cmd.exe /C "
  selection_generic_5:
    ParentImage|endswith: \rundll32.exe
    Image|endswith: \dllhost.exe
    CommandLine: ""
  condition: 1 of selection_generic_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL