Windows: Suspicious command execution spawned by 7zFM.exe for CVE-2022-29072

title: "Windows: Suspicious command execution spawned by 7zFM.exe for CVE-2022-29072"
id: 56784014-a4f6-4c0e-9e1f-cd00a5d4bcef
status: test
description: This rule flags potential exploitation activity by identifying child processes launched by 7zFM.exe where the child image looks like a command interpreter (cmd.exe or PowerShell variants). It further narrows matches by looking for command-line patterns consistent with script or batch execution (including .bat/.cmd/.ps1 endings) and specific command flags. The detection relies on Windows process creation telemetry, including ParentImage, Image, OriginalFileName, and CommandLine.
references:
  - https://github.com/kagancapar/CVE-2022-29072
  - https://twitter.com/kagancapar/status/1515219358234161153
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml
author: frack113, @kostastsale, Huntrule Team
date: 2022-04-17
modified: 2024-08-15
tags:
  - attack.execution
  - cve.2022-29072
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: \7zFM.exe
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  filter_main_extensions_and_flags:
    - CommandLine|contains:
        - " /c "
        - " /k "
        - " /r "
    - CommandLine|endswith:
        - .bat
        - .cmd
        - .ps1
  filter_main_null:
    CommandLine: null
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ee3
    type: derived