WinRAR Creating Files in Startup Locations

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•105

Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.