Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables

Detects 7z/rar executions on Windows with suspicious switches like password and delete options.

FreeReviewedSigma · Medium · v4

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Samir Bousseaden (SigmaHQ), DRL 1.1
Published: 2019-10-15
Updated: 2026-07-31

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags Windows process launches of 7z.exe- and rar.exe-style binaries when their command line includes compression-related options commonly associated with hostile archival and cleanup behavior. Attackers may use these parameters to package data while suppressing deletion safeguards or reducing forensic visibility. The detection relies on process creation telemetry, matching OriginalFileName patterns and substring presence within the CommandLine, while excluding common paths under Program Files.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

Suspicious 7za Archiver Executed from Windows Temp

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

Suspicious Multi-Volume RAR Archiving for Collection by EAGERBEE

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

Suspicious Data Staging via Everything and 7-Zip Prior to Exfiltration via process_creation

Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables

Pivot detection · T1560.001 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-command-line-parameters-for-7z-and-rar-compr-27a72a60

title: "Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables"
id: 60d5259a-af18-42be-ac11-c528243fbb78
status: test
description: This rule flags Windows process launches of 7z.exe- and rar.exe-style binaries when their command line includes compression-related options commonly associated with hostile archival and cleanup behavior. Attackers may use these parameters to package data while suppressing deletion safeguards or reducing forensic visibility. The detection relies on process creation telemetry, matching OriginalFileName patterns and substring presence within the CommandLine, while excluding common paths under Program Files.
references:
  - https://twitter.com/SBousseaden/status/1184067445612535811
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_compression_params.yml
author: Florian Roth (Nextron Systems), Samir Bousseaden, Huntrule Team
date: 2019-10-15
modified: 2023-08-29
tags:
  - attack.collection
  - attack.t1560.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - 7z*.exe
      - "*rar.exe"
      - "*Command*Line*RAR*"
    CommandLine|contains:
      - " -p"
      - " -ta"
      - " -tb"
      - " -sdel"
      - " -dw"
      - " -hp"
  filter_main_generic:
    ParentImage|contains:
      - :\Program Files\
      - :\Program Files (x86)\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 27a72a60-7e5e-47b1-9d17-909c9abafdcd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL