7-Zip RAR5 MotW Bypass Chain: Archive Extraction Followed by Payload Execution (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.