Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable filename ends with WinRAR/RAR (rar.exe or winrar.exe) but the image path is not located under the typical Program Files WinRAR installation directories. Attackers may run compression utilities from unusual directories to package or stage files while blending into normal tool usage. The detection relies on Windows process creation telemetry, matching the executable name and applying path-based exclusions.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrar-or-rar-utility-execution-from-non-default-installation-paths-4ede543c

title: Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths
id: 6fd5265c-2222-45c2-9e71-9c556b6f32b9
status: test
description: This rule flags process creation events where the executable filename ends with WinRAR/RAR (rar.exe or winrar.exe) but the image path is not located under the typical Program Files WinRAR installation directories. Attackers may run compression utilities from unusual directories to package or stage files while blending into normal tool usage. The detection relies on Windows process creation telemetry, matching the executable name and applying path-based exclusions.
references:
  - https://twitter.com/cyb3rops/status/1460978167628406785
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml
author: Florian Roth (Nextron Systems), Tigzy, Huntrule Team
date: 2021-11-17
modified: 2025-07-16
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \rar.exe
        - \winrar.exe
    - Description:
        - Command line RAR
        - WinRAR
  filter_main_unrar:
    Image|endswith: \UnRAR.exe
  filter_main_path:
    Image|contains:
      - :\Program Files (x86)\WinRAR\
      - :\Program Files\WinRAR\
  filter_optional_temp:
    Image|contains: :\Windows\Temp\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate use of WinRAR in a folder of a software that bundles WinRAR
level: medium
license: DRL-1.1
related:
  - id: 4ede543c-e098-43d9-a28f-dd784a13132f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL