Suspicious Child Process Spawned by WinRAR.exe on Windows

Alerts when WinRAR.exe launches command, scripting, or proxy execution binaries on Windows.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-08-31
Updated: 2026-07-30

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where WinRAR.exe spawns execution-related child processes matching common LOLBin patterns (e.g., cmd.exe, PowerShell, mshta, regsvr32, rundll32, cscript, wscript). Such behavior matters because WinRAR activity is often abused as an initial execution vector to run arbitrary commands through spawned system interpreters and script execution binaries. It relies on telemetry that records parent/child process relationships, including ParentImage and Image/OriginalFileName fields.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

Antivirus signatures matching APT malware naming patterns

Antivirus Remote Access Tool Signature Matches Known RAT Names

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Suspicious Child Process Spawned by WinRAR.exe on Windows

Pivot detection · T1203 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-child-process-spawned-by-winrar-exe-on-windows-146aace8

title: Suspicious Child Process Spawned by WinRAR.exe on Windows
id: 3ab8a777-dd44-465d-bab2-3678116a73bf
related:
  - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
    type: similar
  - id: 146aace8-9bd6-42ba-be7a-0070d8027b76
    type: derived
status: test
description: This rule flags Windows process creation events where WinRAR.exe spawns execution-related child processes matching common LOLBin patterns (e.g., cmd.exe, PowerShell, mshta, regsvr32, rundll32, cscript, wscript). Such behavior matters because WinRAR activity is often abused as an initial execution vector to run arbitrary commands through spawned system interpreters and script execution binaries. It relies on telemetry that records parent/child process relationships, including ParentImage and Image/OriginalFileName fields.
references:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WinRAR.exe
  selection_binaries:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - OriginalFileName:
        - Cmd.Exe
        - cscript.exe
        - mshta.exe
        - PowerShell.EXE
        - pwsh.dll
        - regsvr32.exe
        - RUNDLL32.EXE
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL