Flavios Meta

@RedonTG

0 followers0 downloads6 copies0 likes71 views

1 detection

Filters

Last updated

All Time

Detection languages

Microsoft Sentinel (KQL)1

Platforms

Windows1

MITRE Techniques

T1203 - Exploitation for Client Execution1

T1547.001 - Registry Run Keys / Startup Folder1

TA0002 - Execution1

TA0003 - Persistence1

TA0004 - Privilege Escalation1

WinRAR CVE-2025-8088 Exploitation via Startup Folder Persistence

KQL

Detects the exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088) where a compression utility process creates script or shortcut files in the Windows Startup folder for persistence. This technique has been observed in use by the Amaranth-Dragon threat actor.

Flavios Meta@RedonTG

Detections.ai Community

8 months ago

6071