Emerging Threathightest

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)Created Wed Aug 30Updated Mon Jan 22ec3a3c2f-9bb0-4a9b-8f4b-5ec3865443432023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_parent:
        ParentImage|endswith: '\WinRAR.exe'
    selection_folder:
        CommandLine|contains: '\AppData\Local\Temp\Rar$'
    selection_double_ext:
        CommandLine|re: '\.[a-zA-Z0-9]{1,4} \.'
    selection_binaries:
        # Note: add additional binaries that the attacker might use
        - Image|endswith:
              - '\cmd.exe'
              - '\cscript.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\wscript.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'cscript.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'wscript.exe'
    condition: all of selection_*