7-Zip RAR5 Mark-of-the-Web Bypass — Executable Launch After Extraction

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•21

Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.