7-Zip RAR5 MotW Bypass — Executable Launched from 7-Zip Extraction (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•4

Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.