Skip to content
Threat Feed

Tag

Motw-Bypass

1 brief RSS
high advisory

Windows Binary Execution from Archive-Related Paths

Detects the execution of a binary from archive-related paths within a user's Temp directory, potentially indicating attempts to bypass Mark-of-the-Web (MOTW) or exploit vulnerabilities like CVE-2025-0411.

Splunk Enterprise +2 binary-execution archive-bypass motw-bypass
2r 1t 1c