Suspicious Child Process Spawned by WinRAR.exe on Windows

title: Suspicious Child Process Spawned by WinRAR.exe on Windows
id: 3ab8a777-dd44-465d-bab2-3678116a73bf
related:
  - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
    type: similar
  - id: 146aace8-9bd6-42ba-be7a-0070d8027b76
    type: derived
status: test
description: This rule flags Windows process creation events where WinRAR.exe spawns execution-related child processes matching common LOLBin patterns (e.g., cmd.exe, PowerShell, mshta, regsvr32, rundll32, cscript, wscript). Such behavior matters because WinRAR activity is often abused as an initial execution vector to run arbitrary commands through spawned system interpreters and script execution binaries. It relies on telemetry that records parent/child process relationships, including ParentImage and Image/OriginalFileName fields.
references:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WinRAR.exe
  selection_binaries:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - OriginalFileName:
        - Cmd.Exe
        - cscript.exe
        - mshta.exe
        - PowerShell.EXE
        - pwsh.dll
        - regsvr32.exe
        - RUNDLL32.EXE
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1