CVE-2026-46331: 7-Zip RAR5 MotW Strip — Executable Written by 7z.exe
This rule detects the creation of executable or script files within common user-writable directories (Downloads, Desktop, Documents, Temp) when the file writer process is identified as '7z.exe'. This behavior is common in download-and-execute attack chains where an archive is extracted to place malicious payloads on the system.
CQL
