WinRAR Creating Files in Startup Locations

Title: WinRAR Creating Files in Startup Locations
Status: experimental
Description:Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.
References:
  -https://github.com/mulwareX/CVE-2025-6218-POC
  -https://x.com/0x534c/status/1944694507787710685
  -https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-16
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\WinRAR.exe'
      -'\Rar.exe'

    TargetFilename|contains: '\Start Menu\Programs\Startup\'
  condition:selection
Falsepositives:
  -Unknown
Level: high