Windows: WinRAR.exe Application Error Crash on Versions Below 6.23

title: "Windows: WinRAR.exe Application Error Crash on Versions Below 6.23"
id: b63ef28e-3d5d-40e8-b560-bf7ae0e8787c
status: test
description: This rule flags Windows Application Error events where WinRAR.exe crashes (EventID 1000, Provider_Name "Application Error") and the reported AppVersion is not in the fixed release range starting at 6.23. Crashes in vulnerable code paths may indicate attempted exploitation, so correlating these events can help surface likely malicious activity. The detection relies on Windows Application Error telemetry containing Provider_Name, EventID, AppName, and AppVersion.
references:
  - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
  - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
  - https://www.rarlab.com/vuln_rev3_names.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.execution
  - cve.2023-40477
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    AppName: WinRAR.exe
  filter_main_fixed_version:
    AppVersion|startswith:
      - 6.23.
      - 6.24.
      - 6.25.
      - 6.26.
      - "7."
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate crash for reasons other than exploitation of the vulnerability
level: medium
license: DRL-1.1
related:
  - id: e5a29b54-6fe7-4258-8a23-82960e31231a
    type: derived