Water Hydra fallback exploitation: WinRAR CVE-2023-38831 / SmartScreen CVE-2024-

Ibrahim Saud@tektrix

•updated Sep 23, 2026•13•0•13

Detects execution patterns associated with known Water Hydra exploit chains, specifically targeting CVE-2023-38831 (WinRAR self-extracting archive exploitation) and CVE-2024-21412 (Mark-of-the-Web/SmartScreen bypass via nested internet shortcuts). The rule monitors process lineage for WinRAR spawning command interpreters from temporary extraction directories and command line anomalies associated with rundll32.exe triggered from internet shortcut chains.