CVE-2026-45115 7-Zip RAR5 MotW Bypass — Post-Extraction Unsigned Exec

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.