Suspicious WinRAR Child Process Execution Attempt (CVE-2023-38331) on Windows

Alerts on WinRAR spawning command/scripting child processes tied to Temp\Rar$ activity consistent with CVE-2023-38331 exploitation attempts.

FreeUnreviewedSigmahighv1

suspicious-winrar-child-process-execution-attempt-cve-2023-38331-on-windows-ec3a3c2f

title: Suspicious WinRAR Child Process Execution Attempt (CVE-2023-38331) on Windows
id: 878ecab2-ad01-44b8-9eab-135b1d7c1232
related:
  - id: e4556676-fc5c-4e95-8c39-5ef27791541f
    type: similar
  - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
    type: derived
status: test
description: This rule flags Windows process creation events where a WinRAR parent process spawns a child process while operating on temporary Rar extraction content (Temp\Rar$). The behavior matters because exploitation of a WinRAR code execution issue can allow attackers to run arbitrary commands or binaries via spawned scripting or command interpreters. It relies on process creation telemetry including the parent image name, child image/original filename, and command-line patterns associated with Rar extraction and double extensions.
references:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-38831/proc_creation_win_exploit_cve_2023_38831_winrar_child_proc.yml
author: Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-08-30
modified: 2024-01-22
tags:
  - detection.emerging-threats
  - attack.execution
  - attack.t1203
  - cve.2023-38331
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WinRAR.exe
  selection_folder:
    CommandLine|contains: \AppData\Local\Temp\Rar$
  selection_double_ext:
    CommandLine|re: \.[a-zA-Z0-9]{1,4} \.
  selection_binaries:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
    - OriginalFileName:
        - Cmd.Exe
        - cscript.exe
        - PowerShell.EXE
        - pwsh.dll
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where a WinRAR parent process spawns a child process while operating on temporary Rar extraction content (Temp\Rar$). The behavior matters because exploitation of a WinRAR code execution issue can allow attackers to run arbitrary commands or binaries via spawned scripting or command interpreters. It relies on process creation telemetry including the parent image name, child image/original filename, and command-line patterns associated with Rar extraction and double extensions.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.