Windows: WinRAR/Rar creating files in Startup folder paths

title: "Windows: WinRAR/Rar creating files in Startup folder paths"
id: 3b37b5d0-2353-419b-b1e3-d7e371c6dcfc
status: experimental
description: This rule flags file creation events where WinRAR.exe or Rar.exe writes a file under the Windows Startup folder path ("\Start Menu\Programs\Startup\"). Attackers may use Startup folder writes to gain persistence by ensuring a malicious file runs when a user logs in. It relies on Windows file event telemetry capturing the creating process image path and the target filename containing the Startup location.
references:
  - https://github.com/mulwareX/CVE-2025-6218-POC
  - https://x.com/0x534c/status/1944694507787710685
  - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_winrar_file_creation_in_startup_folder.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \WinRAR.exe
      - \Rar.exe
    TargetFilename|contains: \Start Menu\Programs\Startup\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc
    type: derived