Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation

title: Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation
id: 56784014-a4f6-4c0e-9e1f-cd00a5d4bcef
status: test
description: This rule flags Windows process creation where the parent process is 7zFM.exe and the child process image matches common script or command interpreters such as cmd.exe and PowerShell. It then narrows matches by looking for command-line patterns consistent with execution flags and script/command extensions while excluding cases where the command line is null. This behavior is relevant because CVE-2022-29072 exploitation attempts can lead to command execution spawned from 7zFM.exe. The detection relies on process creation telemetry including ParentImage, Image, OriginalFileName, and CommandLine fields.
references:
  - https://github.com/kagancapar/CVE-2022-29072
  - https://twitter.com/kagancapar/status/1515219358234161153
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml
author: frack113, @kostastsale, Huntrule Team
date: 2022-04-17
modified: 2024-08-15
tags:
  - attack.execution
  - cve.2022-29072
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: \7zFM.exe
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  filter_main_extensions_and_flags:
    - CommandLine|contains:
        - " /c "
        - " /k "
        - " /r "
    - CommandLine|endswith:
        - .bat
        - .cmd
        - .ps1
  filter_main_null:
    CommandLine: null
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ee3
    type: derived