CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•2•0•35

Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.