UAC-0226 WinRAR CVE-2025-8088 ADS Drops LNK to Startup + ProgramData Staging

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects WinRAR (winrar.exe) creating shortcut (.lnk) files within the Windows Startup directory or staging suspicious files within specific ProgramData directories. This behavior is indicative of potential persistence mechanisms or malicious staging of secondary payloads by WinRAR.