UAC-0226 WinRAR Path Traversal Writing Files to Startup or ProgramData
Detects WinRAR.exe writing files to sensitive directories such as the Startup folder or C:\ProgramData, potentially indicative of exploitation of path traversal vulnerabilities (CVE-2025-8088, CVE-2025-6218). This activity is associated with UAC-0226's use of WinRAR to establish persistence or stage malicious payloads.
Sigma
