CVE2022

CVE-2022-29072

1Rules

2References

1Folders

2024-08-15Latest

Summary

CVE-2022-29072 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threathightest

Potential CVE-2022-29072 Exploitation Attempt

Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. 7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

WindowsProcess Creation

TA0002 · Executioncve.2022-29072detection.emerging-threats

François HubautSun Apr 172022

References