T1564.004/T1547.001: UAC-0226 WinRAR ADS Path Traversal Drops Files to Startup - CVE-2025-8088
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
Microsoft Sentinel (KQL)
