Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
14
9
6
2
1
Contributors
16
5
3
2
2
Categories
19
17
8
5
5
Platforms
30
2
Products / Services
12
11
7
2
2
MITRE Techniques
19
15
14
14
12
CVEs
71
71
64
58
49
32
Detects the iterative XOR decryption routine signature used to decode the Donut payload in memory prior to execution, specifically looking for large memory write operations initiated by 'setup.exe'.
Detects WinRAR.exe writing HTA files into the Windows Startup directory via traversal sequences in weaponized archives.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Detects WinRAR extracting and launching HTML applications (mshta.exe) or script interpreters (wscript.exe/cscript.exe). This behavior is indicative of the CVE-2025-8088 exploit chain used by Gamaredon to deploy GammaPhish and GammaLoad.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
This rule detects an attempt to exploit a path traversal vulnerability (CVE-2025-8088) in RAR files delivered via HTTP. The exploit leverages Alternate Data Streams (ADS) and specific path traversal patterns to potentially write files outside of the intended directory. The detection is based on the presence of 'STM' in the HTTP response body and a PCRE regex matching a specific path traversal pattern.
Detecting post-exploitation attempts based on RomCom group adversary activity and the following malware/backdoor signatures: Mythic agent, SnipBot and MeltingClaw.
Based on the following threat reports after the WinRAR CVE-2025–8088 exploitation.
1. ESET: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
2. Talos: https://blog.talosintelligence.com/uat-5647-romcom/
Based on the following threat reports after the WinRAR CVE-2025–8088 exploitation.
1. ESET: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
2. Talos: https://blog.talosintelligence.com/uat-5647-romcom/
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder.
This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.
This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.
Page 2 of 2