Selfextracting Archive Execution With Decoy
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
YARA-L
