Gamaredon CVE-2025-8088 WinRAR Startup Folder Drop via Path Traversal
Detects instances where the WinRAR process is used to create or modify files within the Windows startup directory. This behavior is highly suspicious and often indicates an adversary attempting to establish persistence by placing a malicious script or executable in a location that executes automatically upon user login.
SentinelOne
