7-Zip RAR5 MotW Bypass — Executable Extraction Without Zone.Identifier (CVE-2026-45115)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.