Coverage › CVE-2025-0411

CVE-2025-0411 Mapped Sigma

7-Zip Mark of the Web Bypass Vulnerability

Vendor / product

7-Zip — 7-Zip

Description (CISA)

7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.

Added to KEV

2025-02-06

Due date

2025-02-27

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-693

CISA notes

https://www.7-zip.org/history.txt
https://nvd.nist.gov/vuln/detail/CVE-2025-0411

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1553.005 Mark-of-the-Web Bypass exploitation technique

• DET0257 Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files
  AN0712 Windows

  Detects extraction or mounting of container/archive files (e.g., .iso, .vhd, .zip) that originated from the Internet but whose contained files lack Zone.Identifier MOTW tagging. Correlates file creation metadata with subsequent execution of unsigned or untrusted binaries launched outside SmartScreen or Protected View.

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: WatchedExtensions TimeWindow TrustedExtractionTools

Sigma rules tagged attack.t1553.005 (6)

T1566.001 Spearphishing Attachment exploitation technique

• DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms
  AN0655 Windows

  Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.

  m365:unified Send/Receive: Inbound emails with attachments from suspicious or spoofed senders → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: AttachmentExtensions SuspiciousParentChildPairs TimeWindow
  AN0656 Linux

  Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.

  Application:Mail Inbound email attachments logged from MTAs with suspicious metadata → DC0038 Application Log Content

  auditd:SYSCALL execve: Execution of files saved in mail or download directories → DC0032 Process Creation

  NSM:Flow Outbound traffic from suspicious new processes post-attachment execution → DC0078 Network Traffic Flow

  Tunable: AttachmentStoragePaths ScriptInterpreters
  AN0657 macOS

  Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.

  macos:unifiedlog Inbound messages with attachments from suspicious domains → DC0038 Application Log Content

  macos:unifiedlog Execution of Terminal, osascript, or other interpreters originating from Mail or Preview → DC0032 Process Creation

  macos:unifiedlog Attachment files written to ~/Downloads or temporary folders → DC0039 File Creation

  Tunable: ExecutionDelayThreshold SuspiciousParentApps

Sigma rules tagged attack.t1566.001 (24)

All 24 rules on the technique page →

T1588.001 Malware primary impact

• DET0845 Detection of Malware
  AN1977 PRE

  Monitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle. Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.

  Malware Repository None → DC0003 Malware Metadata

  Malware Repository None → DC0011 Malware Content

Sigma rules tagged attack.t1588.001 (1)