Extracting System Files (e.g SAM and SYSTEM logs) with 7-Zip

On August 12, 2026, Hackers Arise posted an article on exfiltration using 7-Zip. Hackers Arise included details on why this can be dangerous. This can result in the extraction of user credentials, and that could be the start of a catastrophic event. Another big one that concerned me most is their claim that EDRs are being bypassed and that exfiltration is not being detected.

I was curious and wanted to learn more about this loophole that could be abused.

How Does The Attack Work?

1. Open 7-Zip as administrator
2. In the address bar, type \\.\; this will show you the available drives and also the physical drives. Note: Once you type \\.\ in the address bar, you will get an error if you try to access any of the letter-assigned drives.
3. Navigate to the file you want to extract. e.g. \\.\PhysicalDrive0\2.Basic data partition.ntfs\Windows\System32\config\SAM.
4. Pick a destination location.
5. SAM file is extracted without any issues.

Limitations Of The Attack

• Target Drive Is Encrypted
  1. Open 7-Zip as administrator
  2. In the address bar, type \\.\; You will see the option for PhysicalDriveX, but this time the data partition is inaccessible. The data partition shows up as .img file instead of .ntfs.
  3. Attempting to open the 2.Basic data partition.img will result in an error
• Launching 7-Zip Not As Administrator
  1. Open 7-Zip
  2. The available drives will be presented to you, but not the physical drives.
  3. You will get an error if you try to navigate through the letter-assigned C drive.
  4. Or trying to access without using the \\.\ path also results in an access is denied error.
• Launching 7-Zip As Administrator But Navigating via Letter-Assigned Drive
  1. Open 7-Zip as administrator
  2. Extracting the SAM file through the C:\Windows\System32\config\ path results in an error.

Hunting/Detecting The Attack Using CrowdStrike Advanced Event Search and CQL

As with Hackers Arise’s claim, my attempts to extract the SAM file from a machine with CrowdStrike Falcon Agent did not flag any activity. There were no detections, alerts, or recorded events in the logs indicating exfiltration.

The biggest challenge in hunting for this attack is that, when exfiltrating via the PhysicalDriveX, the log only records the launch of the 7-Zip executable. However, if the extraction attempt is via C:\Windows\System32\config, even if the attempt fails, the log includes a command line listing the name of the extracted file, which makes hunting easier.

Event Log through CrowdStrike Advanced Event Search after a successful extraction of the SAM file via PhysicalDriveX.

Failed extraction attempt log via C:\Windows\System32\config.

Another item I noticed is that when the extraction attempt is via PhysicalDriveX, the FileName in the logs is 7zFM.exe. And when the extraction is through C:\Windows\System32\config, the FileName is 7zG.exe. See the two images above.

So, the query to use to hunt for this attack is:

#event_simpleName=ProcessRollup2 or SyntheticProcessRollup2
| ImageFileName=/\\7z(g|a|fm)?\.exe$/i
| IntegrityLevel="12288"
| UserName!="*svc" and UserName!="*$" and UserName!="SYSTEM"
| table([@timestamp, ImageFileName, IntegrityLevel, CommandLine])

Some things to note in the query I used:

IntegrityLevel=”12288″ – Filtering only instances where the ImageFileName was executed as administrator.

Removing the IntegrityLevel filter will result in all events relating to 7-Zip. And again, this attack will only work if 7-Zip was executed as administrator. Including the IntegrityLevel will filter out much of the noise.

UserName!=”*svc” and UserName!=”*$” and UserName !=SYSTEM” – Weeding out service accounts and System accounts is going to make your life easy going through the results. You can modify this based on your organization’s service accounts’ naming convention. I just wanted to show you how I did it in my test environment. You can also add UserName to the table to make it easier to identify suspicious users running 7-Zip as an administrator.

Happy Hunting!!!

If you find this content helpful, please subscribe to my blog!