Windows: WinRAR double-extension file creation with space in Temp Rar$ path
Alerts on WinRAR-created Temp Rar$ files with double extensions separated by a space on Windows.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-30
- Updated
- 2026-07-31
What it detects
This rule identifies file creation events where WinRAR.exe creates a file inside an AppData Local Temp Rar$ location with a double extension and a space (e.g., "<ext> <ext>"). Such naming is commonly used to disguise executable or script content and can indicate an exploitation attempt leveraging WinRAR processing. It relies on Windows file event telemetry containing the creating process path and the target filename pattern.
Reporting behind it
- group-ib.comhttps://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- github.comhttps://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-38831/file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-suspicious-double-extension-filename-with-space-via-winrar-e4556676
title: "Windows: WinRAR double-extension file creation with space in Temp Rar$ path"
id: e1218b2c-d56e-4e4f-a623-8aa2ea035384
related:
- id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
type: similar
- id: e4556676-fc5c-4e95-8c39-5ef27791541f
type: derived
status: test
description: This rule identifies file creation events where WinRAR.exe creates a file inside an AppData Local Temp Rar$ location with a double extension and a space (e.g., "<ext> <ext>"). Such naming is commonly used to disguise executable or script content and can indicate an exploitation attempt leveraging WinRAR processing. It relies on Windows file event telemetry containing the creating process path and the target filename pattern.
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-38831/file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-30
tags:
- attack.execution
- cve.2023-38331
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \WinRAR.exe
TargetFilename|contains: \AppData\Local\Temp\Rar$
TargetFilename|re: \.[a-zA-Z0-9]{1,4} \.
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1