Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Tigzy (SigmaHQ), DRL 1.1
Published: 2021-11-17
Updated: 2026-07-30

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable filename ends with WinRAR/RAR (rar.exe or winrar.exe) but the image path is not located under the typical Program Files WinRAR installation directories. Attackers may run compression utilities from unusual directories to package or stage files while blending into normal tool usage. The detection relies on Windows process creation telemetry, matching the executable name and applying path-based exclusions.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

Suspicious 7za Archiver Executed from Windows Temp

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

Suspicious Multi-Volume RAR Archiving for Collection by EAGERBEE

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrar-or-rar-utility-execution-from-non-default-installation-paths-4ede543c

title: Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths
id: 6fd5265c-2222-45c2-9e71-9c556b6f32b9
status: test
description: This rule flags process creation events where the executable filename ends with WinRAR/RAR (rar.exe or winrar.exe) but the image path is not located under the typical Program Files WinRAR installation directories. Attackers may run compression utilities from unusual directories to package or stage files while blending into normal tool usage. The detection relies on Windows process creation telemetry, matching the executable name and applying path-based exclusions.
references:
  - https://twitter.com/cyb3rops/status/1460978167628406785
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml
author: Florian Roth (Nextron Systems), Tigzy, Huntrule Team
date: 2021-11-17
modified: 2025-07-16
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \rar.exe
        - \winrar.exe
    - Description:
        - Command line RAR
        - WinRAR
  filter_main_unrar:
    Image|endswith: \UnRAR.exe
  filter_main_path:
    Image|contains:
      - :\Program Files (x86)\WinRAR\
      - :\Program Files\WinRAR\
  filter_optional_temp:
    Image|contains: :\Windows\Temp\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate use of WinRAR in a folder of a software that bundles WinRAR
level: medium
license: DRL-1.1
related:
  - id: 4ede543c-e098-43d9-a28f-dd784a13132f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL