CVE-2023-38331 Exploitation Attempt - WinRAR Double Extension File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•33

Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.