Potentially Suspicious Child Process Of WinRAR.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•28

This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.