WinRAR Execution in Non-Standard Folder
This rule detects the execution of WinRAR (rar.exe or winrar.exe) from a directory that is not its standard installation path (e.g., 'Program Files\WinRAR'). It specifically excludes 'UnRAR.exe' executions and also filters out executions from the Windows temporary directory ('Windows\Temp') to reduce false positives. This behavior can be indicative of an adversary using a portable or custom-dropped version of WinRAR for archiving data prior to exfiltration, or for other malicious purposes.
Sigma
