7-Zip RAR5 MOTW Bypass - Executable Created by 7z.exe Then Launched

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•0

Detects scenarios where 7-Zip (7z.exe or 7zG.exe) extracts an executable file to a user-writable directory (such as Downloads, Temp, or AppData), potentially stripping the Mark-of-the-Web (MOTW) identifier. The rule specifically tracks instances where such an extracted file is subsequently launched by the shell or Windows explorer within 5 minutes of extraction.