Elastic Defend high stable eql

Potential WinRAR CVE-2023-38831 Exploitation

Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR vulnerability CVE-2023-38831.

View Source

Detection Logic

sequence with maxspan=10s
 [file where event.action == "creation" and process.name : "WinRAR.exe" and
  file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*" and
  not file.extension :  ("exe", "cmd", "bat ", "vbs", "js", "scr ", "com", "wsh", "hta", "pif", "cpl")] by process.entity_id as event0
 [file where event.action == "creation" and process.name : "WinRAR.exe" and
  file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*" and
  file.extension :  ("exe", "cmd", "bat ", "vbs", "js", "scr ", "com", "wsh", "hta", "pif", "cpl") and
  startswith~(file.name, concat(event0.file.name, " "))] by process.entity_id
 [process where event.action == "start" and
  process.parent.name : "winrar.exe" and process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...