huntrule

Suspicious Double Extension with Trailing Space via CVE-2023-38831

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-31
Updated
2026-10-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process command line referencing a file whose document extension is followed by a space and an executable script extension such as image.jpg .cmd. This trailing-space spoofing is the core of CVE-2023-38831 WinRAR exploitation. The pattern indicates an attacker disguising a script as a harmless image or document.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange
Suspicious Chrome Browser Process Spawned by Outlook Indicating Sandbox Escape
Suspicious Equation Editor Child Process via Process Creation
Malicious MSDT Command Line Invoking Follina Payload (via process_creation)
Suspicious Executable with Double Batch Extension (via file_event)
Malicious WPS Office ksoqing Protocol Handler Exploitation via Process Creation
Malicious Startup LNK Dropped by WinRAR via CVE-2025-8088 Path Traversal
Malicious Equation Editor Child Process Indicating Exploit
Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation
Suspicious Child Process Spawned by WinRAR via Process Creation
Suspicious Double Extension with Trailing Space via CVE-2023-38831
Pivot detection · T1203 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.