Windows: WinRAR.exe Application Error Crash on Versions Below 6.23
Flags WinRAR.exe crash events on Windows when the installed version is below 6.23.x.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-31
- Updated
- 2026-07-31
What it detects
This rule flags Windows Application Error events where WinRAR.exe crashes (EventID 1000, Provider_Name "Application Error") and the reported AppVersion is not in the fixed release range starting at 6.23. Crashes in vulnerable code paths may indicate attempted exploitation, so correlating these events can help surface likely malicious activity. The detection relies on Windows Application Error telemetry containing Provider_Name, EventID, AppName, and AppVersion.
Reporting behind it
- wildptr.iohttps://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
- github.comhttps://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
- rarlab.comhttps://www.rarlab.com/vuln_rev3_names.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-winrar-exe-application-error-crash-with-version-below-6-23-e5a29b54
title: "Windows: WinRAR.exe Application Error Crash on Versions Below 6.23"
id: b63ef28e-3d5d-40e8-b560-bf7ae0e8787c
status: test
description: This rule flags Windows Application Error events where WinRAR.exe crashes (EventID 1000, Provider_Name "Application Error") and the reported AppVersion is not in the fixed release range starting at 6.23. Crashes in vulnerable code paths may indicate attempted exploitation, so correlating these events can help surface likely malicious activity. The detection relies on Windows Application Error telemetry containing Provider_Name, EventID, AppName, and AppVersion.
references:
- https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
- https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
- https://www.rarlab.com/vuln_rev3_names.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
- attack.execution
- cve.2023-40477
- detection.emerging-threats
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
AppName: WinRAR.exe
filter_main_fixed_version:
AppVersion|startswith:
- 6.23.
- 6.24.
- 6.25.
- 6.26.
- "7."
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate crash for reasons other than exploitation of the vulnerability
level: medium
license: DRL-1.1
related:
- id: e5a29b54-6fe7-4258-8a23-82960e31231a
type: derived