Windows WinRAR .rev File Creation Potential Exploitation (CVE-2023-40477)

Alert on .rev file creation tied to WinRAR/Explorer on Windows as an indicator of potential CVE-2023-40477 exploitation.

FreeUnreviewedSigmalowv1

windows-winrar-rev-file-creation-potential-exploitation-cve-2023-40477-c3bd6c55

title: Windows WinRAR .rev File Creation Potential Exploitation (CVE-2023-40477)
id: 12ea9f0a-c8fe-45b4-8a5a-7e7ea2e32669
status: test
description: This rule flags creation of files with a .rev extension associated with WinRAR execution paths (including cases involving Explorer launching WinRAR). Attackers may use archive extraction to trigger behaviors related to CVE-2023-40477, making timely file creation an early indicator. The detection relies on Windows file event telemetry capturing the creating process image and the target filename suffix, and it can be triaged by checking for suspicious follow-on execution or WinRAR crashes.
references:
  - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
  - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
  - https://www.rarlab.com/vuln_rev3_names.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.execution
  - cve.2023-40477
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \explorer.exe
      - \WinRAR.exe
    TargetFilename|endswith: .rev
  condition: selection
falsepositives:
  - Legitimate extraction of multipart or recovery volumes ZIP files
level: low
license: DRL-1.1
related:
  - id: c3bd6c55-d495-4c34-918e-e03e8828c074
    type: derived

What it detects

This rule flags creation of files with a .rev extension associated with WinRAR execution paths (including cases involving Explorer launching WinRAR). Attackers may use archive extraction to trigger behaviors related to CVE-2023-40477, making timely file creation an early indicator. The detection relies on Windows file event telemetry capturing the creating process image and the target filename suffix, and it can be triaged by checking for suspicious follow-on execution or WinRAR crashes.

Known false positives

Legitimate extraction of multipart or recovery volumes ZIP files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.