CL-STA-1062 WinRAR Archiving Web Source Code for Staged Exfiltration

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

Detects the use of WinRAR or rar.exe to archive sensitive web directory content (e.g., wwwroot, web.config, database files) when spawned from web server processes like w3wp.exe or cmd.exe. This behavior is indicative of data staging for exfiltration, a common tactic for actors like those associated with the CL-STA-1062 intrusion campaign.