CVE-2025-8088

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessFileName =~ "WinRAR.exe" or InitiatingProcessFileName =~ "Rar.exe" or InitiatingProcessFileName =~ "UnRAR.exe"
| where FileName endswith ".lnk" or FileName endswith ".hta" or FileName endswith ".vbs" or FileName endswith ".dll"
| where FolderPath contains @"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" or FolderPath contains @"\Temp\" or FolderPath contains @"\Local\"
| where not (FolderPath contains @"\Rar$" or FolderPath contains @"\WinRAR$") // Exclude legitimate WinRAR temp folders
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| join kind=inner (DeviceProcessEvents
    | where InitiatingProcessFileName =~ "WinRAR.exe" or InitiatingProcessFileName =~ "Rar.exe" or InitiatingProcessFileName =~ "UnRAR.exe"
    | where ProcessCommandLine contains ".lnk" or ProcessCommandLine contains ".hta" or ProcessCommandLine contains ".vbs" or ProcessCommandLine contains "powershell.exe"
    | project Timestamp, DeviceName, ProcessCommandLine, FileName, InitiatingProcessFileName, InitiatingProcessParentFileName
) on DeviceName, Timestamp
| extend Anomaly = "Possible WinRAR Path Traversal Exploit"
| project Anomaly, Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) 
| (Image="*\\WinRAR.exe" OR Image="*\\Rar.exe" OR Image="*\\UnRAR.exe") 
| (TargetFilename="*.lnk" OR TargetFilename="*.hta" OR TargetFilename="*.vbs" OR TargetFilename="*.dll") 
| (TargetFilename="*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" OR TargetFilename="*\\Temp\\*" OR TargetFilename="*\\Local\\*") 
| NOT (TargetFilename="*\\Rar$\\" OR TargetFilename="*\\WinRAR$\\" ) 
| stats count by _time, Host, Image, TargetFilename, CommandLine 
| rename Image as InitiatingProcessFileName, TargetFilename as FileName, CommandLine as ProcessCommandLine 
| eval Anomaly = "Possible WinRAR Path Traversal Exploit" 
| table Anomaly, _time, Host, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: WinRAR Path Traversal Exploit
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation of CVE-2025-8088 in WinRAR by monitoring for suspicious file creations and process executions after archive extraction.
author: SecBoard Operations
date: 2024/01/01
modified: 2024/01/01
references:
  - https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
tags:
  - attack.execution
  - attack.persistence
  - cve.2025.8088
logsource:
  category: process_creation
  product: windows
detection:
  selection_winrar_process:
    ParentImage|endswith:
      - '\WinRAR.exe'
      - '\Rar.exe'
      - '\UnRAR.exe'
  selection_suspicious_file:
    Image|endswith:
      - '.lnk'
      - '.hta'
      - '.vbs'
      - '.dll'
    CommandLine|contains:
      - 'powershell.exe'
      - 'cmd.exe'
  selection_target_path:
    CommandLine|contains:
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\Temp\'
      - '\Local\'
  filter_legitimate_temp:
    CommandLine|contains:
      - '\Rar$\'
      - '\WinRAR$\'
  condition: selection_winrar_process and selection_suspicious_file and selection_target_path and not filter_legitimate_temp
fields:
  - CommandLine
  - ParentImage
  - Image
level: high

Elastic ES|QL

from process where
  (process.parent.executable.full_path : "*\\WinRAR.exe" or process.parent.executable.full_path : "*\\Rar.exe" or process.parent.executable.full_path : "*\\UnRAR.exe") and
  (process.executable.full_path : "*.lnk" or process.executable.full_path : "*.hta" or process.executable.full_path : "*.vbs" or process.executable.full_path : "*.dll") and
  (process.command_line : "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" or process.command_line : "*\\Temp\\*" or process.command_line : "*\\Local\\*") and
  not (process.command_line : "*\\Rar$\\" or process.command_line : "*\\WinRAR$\\" ) and
  (process.command_line : "*powershell.exe*" or process.command_line : "*cmd.exe*")
|
  select
    @timestamp,
    host.name,
    process.parent.executable.full_path as winrar_process,
    process.executable.full_path as suspicious_file,
    process.command_line as command_line,
    'Possible WinRAR Path Traversal Exploit' as anomaly_description