CVE-2025-8088 WinRAR 0-day Path Traversal Exploited via COM Hijacking
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Microsoft Sentinel (KQL)
