Gamaredon CVE-2025-8088 WinRAR path traversal dropping HTA to Startup folder
Detects instances where the WinRAR utility process creates, writes, or drops a file into the Windows Startup folder. This behavior is a common technique used by adversaries to achieve persistence, as any executable placed in this folder will automatically run upon user login.
Splunk (SPL)
