SFX archive launching decoy and hidden stage
This rule detects the execution of self-extracting (SFX) archives that launch both a visible decoy and a hidden second executable from the temporary directory. It specifically looks for process command lines containing patterns indicative of 7-zip or generic SFX archive execution, combined with an actor process image name suggesting an archive utility or installer. The rule aims to identify malicious SFX archives used in multi-stage attacks, providing causality fields for investigation.
Cortex XDR
