Gamaredon CVE-2025-8088 WinRAR Spawning Scripting Engine for PteroSetup Delivery
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
CQL
