Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation
Alerts when 7zFM.exe spawns cmd.exe or PowerShell with command-line patterns consistent with CVE-2022-29072 exploitation attempts.
- Product
- windows
- Category
- process_creation
- Author
- frack113, @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-04-17
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation where the parent process is 7zFM.exe and the child process image matches common script or command interpreters such as cmd.exe and PowerShell. It then narrows matches by looking for command-line patterns consistent with execution flags and script/command extensions while excluding cases where the command line is null. This behavior is relevant because CVE-2022-29072 exploitation attempts can lead to command execution spawned from 7zFM.exe. The detection relies on process creation telemetry including ParentImage, Image, OriginalFileName, and CommandLine fields.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation
id: 56784014-a4f6-4c0e-9e1f-cd00a5d4bcef
status: test
description: This rule flags Windows process creation where the parent process is 7zFM.exe and the child process image matches common script or command interpreters such as cmd.exe and PowerShell. It then narrows matches by looking for command-line patterns consistent with execution flags and script/command extensions while excluding cases where the command line is null. This behavior is relevant because CVE-2022-29072 exploitation attempts can lead to command execution spawned from 7zFM.exe. The detection relies on process creation telemetry including ParentImage, Image, OriginalFileName, and CommandLine fields.
references:
- https://github.com/kagancapar/CVE-2022-29072
- https://twitter.com/kagancapar/status/1515219358234161153
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml
author: frack113, @kostastsale, Huntrule Team
date: 2022-04-17
modified: 2024-08-15
tags:
- attack.execution
- cve.2022-29072
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection_parent:
ParentImage|endswith: \7zFM.exe
selection_img:
- Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- Cmd.Exe
- PowerShell.EXE
- pwsh.dll
filter_main_extensions_and_flags:
- CommandLine|contains:
- " /c "
- " /k "
- " /r "
- CommandLine|endswith:
- .bat
- .cmd
- .ps1
filter_main_null:
CommandLine: null
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ee3
type: derived