LoFP LoFP / some installers, administrative packages, or automation workflows may extract and run binaries from archive files in temporary directories. review the parent process, executed path, and user context before tuning approved activity.

Techniques

Sample rules

Windows Binary Execution from an Archive

Description

Detects the execution of a binary from archive-related paths in the user’s Temp directory. It looks for binaries launched by explorer.exe, winrar.exe, or 7zFM.exe, where the executed process path includes Temp and archive markers such as RAR, 7z, or ZIP. This was abused by attackers to bypass Mark-of-the-Web (MOTW) such as CVE-2025-0411 or exploit certain vulnerabilities.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.parent_process_name IN (
    "explorer.exe",
    "winrar.exe",
    "7zFM.exe"
)
Processes.process_path="*\\AppData\\Local\\Temp\\*"
Processes.process_path IN (
    "*\\rar*",
    "*\\7z*",
    "*.zip*"
)

by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
   Processes.parent_process_name Processes.parent_process_exec Processes.action
   Processes.dest Processes.process_current_directory Processes.process_path
   Processes.process_integrity_level Processes.original_file_name
   Processes.parent_process Processes.parent_process_path
   Processes.parent_process_guid Processes.parent_process_id
   Processes.process_guid Processes.process_id
   Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_binary_execution_from_an_archive_filter`