UAC-0226 WinRAR CVE-2025-8088 ADS Path Traversal Dropping LNK to Startup
This rule detects potentially malicious activity involving the WinRAR utility. It monitors for WinRAR creating files in Windows Startup folders, dropping files in specific ProgramData subdirectories often associated with staging malicious payloads, and spawning suspicious child processes such as command shells, scripting engines, or HTML applications.
Cortex XDR
