CVE-2023-40477 Potential Exploitation - .REV File Creation
Detects the creation of ".rev" files by WinRAR, which can indicate potential exploitation of CVE-2023-40477. This vulnerability allows for arbitrary code execution. The rule looks for file creation events where the process is either 'explorer.exe' (suggesting extraction via context menu) or 'WinRAR.exe', and the created file has a '.rev' extension. Further investigation for suspicious execution or WinRAR application crashes shortly after such file creation is recommended.
Sigma
