Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
Platforms
2
Products / Services
2
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.