Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

7Zip Compressing Dump Files

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Tue Sep 27Updated Tue Sep 12ec570e53-4c76-45a9-804d-dc3f355ff7a7windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Description|contains: '7-Zip'
        - Image|endswith:
              - '\7z.exe'
              - '\7zr.exe'
              - '\7za.exe'
        - OriginalFileName:
              - '7z.exe'
              - '7za.exe'
    selection_extension:
        CommandLine|contains:
            - '.dmp'
            - '.dump'
            - '.hdmp'
    condition: all of selection_*
False Positives

Legitimate use of 7z with a command line in which ".dmp" or ".dump" appears accidentally

Legitimate use of 7z to compress WER ".dmp" files for troubleshooting

References
1
Resolving title…
thedfirreport.com
MITRE ATT&CK
Related Rules
DerivedDetectionmedium

Winrar Compressing Dump Files

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
ec570e53-4c76-45a9-804d-dc3f355ff7a7
Status
test
Level
medium
Type
Detection
Created
Tue Sep 27
Modified
Tue Sep 12
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml
Raw Tags
attack.collectionattack.t1560.001
View on GitHub