Windows File Creation: Suspicious Double-Extension Filename with Space via WinRAR Temp Rar$

Alerts on WinRAR-created Temp Rar$ files with double extensions separated by a space on Windows.

FreeUnreviewedSigmahighv1

windows-file-creation-suspicious-double-extension-filename-with-space-via-winrar-e4556676

title: "Windows File Creation: Suspicious Double-Extension Filename with Space via WinRAR Temp Rar$"
id: e1218b2c-d56e-4e4f-a623-8aa2ea035384
related:
  - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
    type: similar
  - id: e4556676-fc5c-4e95-8c39-5ef27791541f
    type: derived
status: test
description: This rule flags Windows file creation events where WinRAR.exe creates a file in the Temp Rar$ working directory with a double extension separated by a space. Attackers often use double extensions and crafted filenames to disguise executable or script content. The detection relies on process execution context (WinRAR.exe) and file event telemetry capturing TargetFilename patterns (double extension with a space under AppData\Local\Temp\Rar$).
references:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-38831/file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-30
tags:
  - attack.execution
  - cve.2023-38331
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \WinRAR.exe
    TargetFilename|contains: \AppData\Local\Temp\Rar$
    TargetFilename|re: \.[a-zA-Z0-9]{1,4} \.
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows file creation events where WinRAR.exe creates a file in the Temp Rar$ working directory with a double extension separated by a space. Attackers often use double extensions and crafted filenames to disguise executable or script content. The detection relies on process execution context (WinRAR.exe) and file event telemetry capturing TargetFilename patterns (double extension with a space under AppData\Local\Temp\Rar$).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.