UAC-0226 WinRAR ADS Path Traversal (CVE-2025-8088) Dropping Files to Startup or ProgramData

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects instances where the WinRAR or Unrar process writes a new executable or script file to the Windows Startup folder or ProgramData directory within a 30-second window. This behavior is commonly associated with archive extraction-based persistence or staging of malicious files.