Windows: Detect WinRAR Creating .rev Files Associated with CVE-2023-40477
Alert on .rev file creation tied to WinRAR/Explorer on Windows as an indicator of potential CVE-2023-40477 exploitation.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-31
- Updated
- 2026-07-31
What it detects
This rule matches file creation events where WinRAR or Explorer creates a file ending in “.rev”. Creating these files can be indicative of activity related to CVE-2023-40477, so it’s useful as a precursor signal during exploitation attempts. It relies on Windows file event telemetry that includes the creating process path and the created target filename. Alerting on follow-on suspicious execution shortly after creation or WinRAR crashes can help increase confidence.
Reporting behind it
- wildptr.iohttps://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
- github.comhttps://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
- rarlab.comhttps://www.rarlab.com/vuln_rev3_names.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-winrar-rev-file-creation-potential-exploitation-cve-2023-40477-c3bd6c55
title: "Windows: Detect WinRAR Creating .rev Files Associated with CVE-2023-40477"
id: 12ea9f0a-c8fe-45b4-8a5a-7e7ea2e32669
status: test
description: This rule matches file creation events where WinRAR or Explorer creates a file ending in “.rev”. Creating these files can be indicative of activity related to CVE-2023-40477, so it’s useful as a precursor signal during exploitation attempts. It relies on Windows file event telemetry that includes the creating process path and the created target filename. Alerting on follow-on suspicious execution shortly after creation or WinRAR crashes can help increase confidence.
references:
- https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
- https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
- https://www.rarlab.com/vuln_rev3_names.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-40477/file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
- attack.execution
- cve.2023-40477
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \explorer.exe
- \WinRAR.exe
TargetFilename|endswith: .rev
condition: selection
falsepositives:
- Legitimate extraction of multipart or recovery volumes ZIP files
level: low
license: DRL-1.1
related:
- id: c3bd6c55-d495-4c34-918e-e03e8828c074
type: derived