Title:
7Zip Compressing Dump Files
Status:
test
Description:Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
References:
-https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-27
modified:2026-06-05
Tags:
- -'attack.collection'
- -'attack.t1560.001'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Description|contains:
'7-Zip'
- Image|endswith:
- '\7z.exe'
- '\7zr.exe'
- '\7za.exe'
- OriginalFileName:
- '7z.exe'
- '7za.exe'
- '7zr.exe'
selection_extension:
CommandLine|contains:
-'.dmp'
-'.dump'
-'.hdmp'
condition:
all of selection_*
Falsepositives:
-Legitimate use of 7z with a command line in which ".dmp" or ".dump" appears accidentally
-Legitimate use of 7z to compress WER ".dmp" files for troubleshooting
Level:
medium
