Inflated Executable Created By Archive Utility
This rule detects the creation of executable files (.exe) by common archive utilities such as 7-Zip, WinRAR, tar, or PowerShell. It specifically targets scenarios where these utilities are used to extract or create executables, which can be indicative of malware unpacking or staging. The rule focuses on the process responsible for the file creation and the type of file being created, aiming to identify potentially malicious activity involving compressed or archived executables.
YARA-L
