7-Zip RAR5 MoTW Bypass (CVE-2026-46331) - Executable Extracted to User Path
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
Cortex XDR
