Gamaredon CVE-2025-8088 WinRAR Path Traversal HTA Drop to Startup Folder

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•7

This rule detects potential exploitation of CVE-2025-8088 involving WinRAR or unrar processing malicious archives with path traversal characters (../ or ..\). It identifies the extraction of script files (HTA, VBS, PS1, BAT) into the Windows Startup folder, followed by the execution of these files via mshta.exe or wscript.exe within a 30-second window, characteristic of Gamaredon group persistence mechanisms.