Elastic Defend high stable eql

Potential Execution via WinRAR Exploitation

Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR vulnerability CVE-2023-38831.

View Source

Detection Logic

process where event.action == "start" and
(
 (process.parent.name : "WinRAR.exe" and
  process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*" and
  (process.args : ("* .exe", "* .cmd", "* .bat", "* .vbs", "* .js", "* .scr", "* .com", "* .wsh", "* .hta", "* .pif", "* .cpl") or
   process.args : (".exe ", ".cmd ", ".bat ", ".vbs ", ".js ", ".scr ", ".com ", ".wsh ", ".hta ", ".pif ", ".cpl"))) or

  descendant of [process where event.action == "start" and process.parent.name : "WinRAR.exe" and
                  process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*" and
                  (process.args : ("* .exe", "* .cmd", "* .bat", "* .vbs", "* .js", "* .scr", "* .com", "* .wsh", "* .hta", "* .pif", "* .cpl") or
                   process.args : (".exe ", ".cmd ", ".bat ", ".vbs ", ".js ", ".scr ", ".com ", ".wsh ", ".hta ", ".pif ", ".cpl "))]
 ) and
 not (process.executable : "?:\\Program Files*\\Microsoft\\Edge\\Application\\*.exe" and
      process.parent.executable : "?:\\Program Files*\\Microsoft\\Edge\\Application\\msedge.exe") and
 not (process.executable : "?:\\Windows\\System32\\conhost.exe" and process.args : "0xffffffff")

Field Validations

Loading…

Comments (0)

Loading comments...