CVE2023

CVE-2023-38831

2Rules

2References

1Folders

2024-01-22Latest

Summary

CVE-2023-38831 is tracked here through 2 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2023. Coverage centers on windows / file_event, windows / process_creation.

Related Detections

Search this threat

hightestEmerging Threat

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

windowsprocess_creation

2024-01-22

hightestEmerging Threat

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

windowsfile_event

2023-08-30

References