{"id":"146aace8-9bd6-42ba-be7a-0070d8027b76","title":"Potentially Suspicious Child Process Of WinRAR.EXE","description":"Detects potentially suspicious child processes of WinRAR.exe.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-31","modified":"","tags":["attack.execution","attack.t1203"],"technique_ids":["T1203"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/","https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md"],"source_path":"rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml","source_sha256":"8a4fe6f4ee1425583740e8269f39b07fd793fd84ccb3dd17dae753894536ab32","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Child Process Of WinRAR.EXE\nid: 146aace8-9bd6-42ba-be7a-0070d8027b76\nrelated:\n    - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343\n      type: similar\nstatus: test\ndescription: Detects potentially suspicious child processes of WinRAR.exe.\nreferences:\n    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/\n    - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-08-31\ntags:\n    - attack.execution\n    - attack.t1203\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\WinRAR.exe'\n    selection_binaries:\n        # Note: add additional binaries that the attacker might use\n        - Image|endswith:\n              - '\\cmd.exe'\n              - '\\cscript.exe'\n              - '\\mshta.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\wscript.exe'\n        - OriginalFileName:\n              - 'Cmd.Exe'\n              - 'cscript.exe'\n              - 'mshta.exe'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n              - 'regsvr32.exe'\n              - 'RUNDLL32.EXE'\n              - 'wscript.exe'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/146aace8-9bd6-42ba-be7a-0070d8027b76.json","kind":"sigma"}