Potential Execution via Archive Exploit

[rule]
description = """
Identifies when common third party decompression utilities are creating a file in the user Startup folder. This may
indicate the successful exploitation of a path traversal vulnerability to enable unauthorized execution at the next user
logon.
"""
id = "a8e974cd-e811-4321-bf89-e22d0252c8c3"
license = "Elastic License v2"
name = "Potential Execution via Archive Exploit"
os_list = ["windows"]
reference = [
    "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-6218",
    "https://www.zerodayinitiative.com/advisories/ZDI-25-409/",
]
version = "1.0.3"

query = '''
file where event.action in ("creation", "overwrite", "rename", "modification") and
 process.name : ("WinRAR.exe", "Bandizip.exe", "7zFM.exe", "7zG.exe") and
 file.path : "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" and
 not file.name : "desktop.ini"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"