Windows: WinRAR.exe Application Error Crash with Version Below 6.23

title: "Windows: WinRAR.exe Application Error Crash with Version Below 6.23"
id: b63ef28e-3d5d-40e8-b560-bf7ae0e8787c
status: test
description: This rule identifies Windows Application Error events where WinRAR.exe crashes (Event ID 1000, Provider_Name 'Application Error') and the recorded application version is less than 6.23.x (6.23. / 6.24. / 6.25. / 6.26. / 7. are excluded). Crashing WinRAR could indicate attempted exploitation of the corresponding vulnerability, making it important to triage systems with affected app versions. It relies on Windows Application Error telemetry that includes the crashing process name and its app version.
references:
  - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
  - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
  - https://www.rarlab.com/vuln_rev3_names.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.execution
  - cve.2023-40477
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    AppName: WinRAR.exe
  filter_main_fixed_version:
    AppVersion|startswith:
      - 6.23.
      - 6.24.
      - 6.25.
      - 6.26.
      - "7."
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate crash for reasons other than exploitation of the vulnerability
level: medium
license: DRL-1.1
related:
  - id: e5a29b54-6fe7-4258-8a23-82960e31231a
    type: derived