WinRAR MoTW Propagation Privacy, (Tue, Jul 22nd)
ID: 14f897e6-a01a-59be-8c86-50c5dd2a89cc
STIX ID: report--14f897e6-a01a-59be-8c86-50c5dd2a89cc
Feed Name: SANS ISC Diary
The report notes that WinRAR 7.10+ introduces a privacy feature that redacts most Mark-of-the-Web metadata when extracting files from downloaded archives, propagating only the ZoneId while removing the ReferredUrl and HostUrl fields; this default behavior can be disabled and may impact forensic provenance tracking.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.