CL-STA-1062 WinRAR Staging with -k -r -s Flags Spawned by Web Server or cmd

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects the execution of 'rar.exe' with specific command-line arguments indicative of file archiving or extraction (using switches like '-k', '-r', '-s', '-t', '-o-p'). The rule monitors for instances where this activity originates from a web server process (w3wp.exe) or command interpreter (cmd.exe), or involves specific sensitive paths like backups or VMware configuration directories, which may suggest unauthorized data staging or exfiltration preparation.