7-Zip RAR5 MotW Bypass — Executable Launched Without Zone.Identifier (CVE-2026-45115)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.