Identifier / Programs / Linux and Unix
7z
File archiver with a high compression ratio. tldr-pages
GTFOBins file-read 1 documented command
How 7z is abused
file-read
-ttar-an-so-siEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for 7z.
1 documented command
file-read unprivileged, with sudo
7z a -ttar -an -so /path/to/input-file | 7z e -ttar -si -soThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for 7z. The identifier reads the line that runs 7z.
Everyday use
add a file or directory to a new or existing archive
7z a path/to/archive.7z path/to/file_or_directoryIdentifyEncrypt an existing archive (including filenames)
7z a path/to/encrypted.7z -ppassword -mhe=on path/to/archive.7zIdentifyExtract an archive preserving the original directory structure
7z x path/to/archive.7zIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.