7-Zip Default Setting Lets Extracted Files Bypass Windows SmartScreen

7-Zip’s default configuration allows files extracted from internet-delivered archives to shed the Mark of the Web (MotW), meaning Windows SmartScreen never runs its reputation check and unsigned payloads can execute without a “Windows protected your PC” warning.

That behavior, long treated as a red-team trick, is now formally recognized and tracked in multiple 7-Zip vulnerabilities, underscoring a persistent gap in SmartScreen’s coverage on Windows systems that rely on third-party archivers.

In a recent phishing-focused engagement, a Sliver C2 beacon wrapped in a ShellcodePack launcher was tuned until it bypassed Microsoft Defender for Endpoint (MDE) completely: no static detection on write, no behavioral alert on execution, and a clean beacon-to-C2.

The same payload, delivered via a realistic phishing flow email link, browser download, Explorer double-click was immediately blocked, not by MDE, but by Windows SmartScreen.

The difference was MotW: modern browsers write a Zone. Identifier alternate data stream (ADS) with ZoneId=3 to downloaded files, flagging them as originating from the Internet.

SmartScreen keys off that flag, then queries Microsoft’s cloud for reputation. Unsigned, never-before-seen payloads fail this check by design and are hard-blocked, even when Defender’s engines are silent.

Critically, SmartScreen and MDE are independent controls. A payload that is invisible to Defender can still be stopped cold if MotW is present and execution is shell-invoked from Explorer.

Conversely, direct PowerShell invocation or execution from paths that never carry MotW will bypass SmartScreen entirely; the execution context determines which control actually fires.

On current Windows 11 builds, Microsoft has closed several historical MotW gaps. Explorer’s built-in ZIP handling now propagates MotW from password-protected archives to extracted binaries, and ISO mounting has been hardened so container boundaries no longer routinely strip the Zone identifier tag.

Modern Chromium-based browsers (Chrome, Edge, Brave) and Firefox all write MotW for downloads, including blob:/data: URL reconstruction; HTML smuggling remains primarily a perimeter evasion technique, not an endpoint MotW bypass.

Edge goes further by integrating SmartScreen into the download path, giving defenders an additional pre-execution decision point.

Third-party archival tools, however, remain a weak link. For years, 7-Zip simply did not honor MotW propagation by default.

7-Zip Default Setting

Attackd researchers have documented that 7-Zip only exposes MotW handling as an opt-in feature (“Propagate Zone.Id stream”), which ships set to “No,” meaning extracted files lose their internet-origin flag and avoid SmartScreen’s reputation gate.

More recently, the issue escalated from configuration quirk to exploitable vulnerability: CVE-2025-0411 describes a nested-archive scenario where a MotW-tagged outer archive contains an inner archive whose contents emerge without MotW, allowing attacker-controlled executables to run without SmartScreen prompts.

Even after the 24.09 fix for the nested-archive case, additional MotW handling bugs have been reported.

CVE-2026-58052 shows that 7-Zip up to 26.02 can still fail to preserve MotW when extracting crafted RAR5 archives, effectively overwriting ZoneId=3 with ZoneId=0 via NTFS stream canonicalization and defeating SmartScreen/MotW warnings while spoofing file content.

In practical terms, any environment running vulnerable or misconfigured 7-Zip builds exposes a reliable path for SmartScreen bypass via archive extraction, especially in developer-heavy or technical populations where 7-Zip is widely installed.

SmartScreen’s decision logic is straightforward: if a file is MotW-marked and launched through the shell, SmartScreen checks whether it is signed by a recognized publisher and whether that file hash has established positive reputation in Microsoft’s telemetry.

Historically, Extended Validation (EV) code signing certificates bought instant SmartScreen reputation an EV-signed installer would skip the warning on first download.

That shortcut is gone. Microsoft’s Trusted Root Program changes in 2024 removed EV-specific OIDs; as of current documentation, EV and OV certificates build reputation the same way, through clean download volume and consistent signing.

For defenders and software publishers, this means code signing remains essential for identity assurance and long-term trust, but it no longer guarantees SmartScreen bypass on day one.

For attackers, purchasing a legitimate certificate is still a meaningful barrier, and abusing edge cases such as CVE-2013-3900 (WinVerifyTrust certificate padding) requires additional sophistication and environment-specific mitigations.

The engagement described above surfaced an important reality: SmartScreen is an effective, often under-credited control against unsigned, browser-delivered payloads, and documenting it as “held” rather than “bypassed” is the accurate assessment.

EDR evasion alone does not guarantee execution; MotW and SmartScreen frequently provide the last line of defense.

For defenders, the key actions are clear. First, test SmartScreen behavior on your actual OS and browser stack, including Edge and non-Edge deployments, and validate whether cloud reputation checks fail open or closed under your egress policies.

Second, inventory third-party archivers, especially 7-Zip, and either update to patched builds (24.09+ for the nested-archive flaw, 26.03+ for RAR5 MotW handling) or enforce configuration that propagates Zone.Id streams.

Finally, treat SmartScreen as one layer in a broader control set: it only fires on shell-invoked execution of MotW-marked files, and payloads delivered via internal shares, USB, or scripted paths will never hit this control at all.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide