CL-STA-1062 WinRAR data staging with recursive and lock flags from web server context

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects the use of WinRAR (rar.exe) to archive files using command-line arguments indicative of data staging or exfiltration (such as continuous archiving or specific extraction flags). The rule focuses on executions originating from suspicious parent processes like web servers (w3wp.exe) or command shells, or occurring within sensitive directories such as backup locations or VMware application folders.