UAC-0226 WinRAR ADS Path Traversal LNK Drop in Startup Folder (CVE-2025-6218)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•5

Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.