Oversized Executable Created by Archiver

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•2

This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.