Potential Execution via ZIPExec

sequence with maxspan=5m

  /* cmdkey invoking Windows Shell to open a compressed file */
 [process where event.action == "start" and
   process.pe.original_file_name : "cmdkey.exe" and
   process.command_line : "*Microsoft_Windows_Shell*Folder*filename*"] by process.parent.entity_id

 /* executable file creation by parent of cmdkey*/
 [file where event.action == "creation" and file.Ext.header_bytes : "4d5a*"] by process.entity_id

 /* execution from Explorer temp decompression directory by parent of cmdkey */
 [process where event.action == "start" and process.command_line : "*\\Temp\\Temp?_*"] by process.parent.entity_id