CL-STA-1062 WinRAR Staging of Web Source via Password-Protected RAR Archive

Ibrahim Saud@tektrix

•updated Jun 26, 2026•3•0•5

Detects the use of WinRAR (rar.exe) to archive files containing web server or database source code. The detection monitors for common staging flags (-k, -r, -s, -m1), password protection (-hp), or output paths indicative of staging activity (e.g., to a 'backup' directory or 'web.rar'), originating from standard Windows program file paths.