Gamaredon CVE-2025-8088 WinRAR Startup Folder Drop and Execution

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

This rule detects a multi-stage attack chain where a WinRAR or UnRAR process, spawned by an email client (Outlook or Thunderbird), extracts files directly into the Windows startup directory. It then correlates this with the execution of common scripting or command-line tools (such as mshta, wscript, powershell, or cmd) from that same startup location within 30 seconds of the extraction event.