Emerging Threatmediumtest

CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Aug 31e5a29b54-6fe7-4258-8a23-82960e31231a2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Windowsapplication

ProductWindows← raw: windows

Serviceapplication← raw: application

Detection Logic

detection:
    selection:
        Provider_Name: 'Application Error'
        EventID: 1000
        AppName: 'WinRAR.exe'
    filter_main_fixed_version:
        # TODO: fix this when the "lt" modifier is implemented for software versions
        AppVersion|startswith:
            - '6.23.'
            - '6.24.'
            - '6.25.'
            - '6.26.'
            - '7.'
    condition: selection and not 1 of filter_main_*