Gamaredon WinRAR CVE-2025-8088 HTA Written to Startup Folder
Detects the WinRAR process creating or modifying files within the Windows Startup folder. This activity is a common technique used by attackers to achieve persistence by ensuring that a malicious payload or script is executed automatically upon user logon.
SentinelOne
