Potential Execution via WinRAR Exploitation

[rule]
description = """
Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR
vulnerability CVE-2023-38831.
"""
id = "1eb1c26f-c360-4fd5-a549-6149e16d8e96"
license = "Elastic License v2"
name = "Potential Execution via WinRAR Exploitation"
os_list = ["windows"]
reference = [
    "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
    "https://github.com/b1tg/CVE-2023-38831-winrar-exploit/tree/main",
]
version = "1.0.5"

query = '''
process where event.action == "start" and
(
 (process.parent.name : "WinRAR.exe" and
  process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*" and
  (process.args : ("* .exe", "* .cmd", "* .bat", "* .vbs", "* .js", "* .scr", "* .com", "* .wsh", "* .hta", "* .pif", "* .cpl") or
   process.args : (".exe ", ".cmd ", ".bat ", ".vbs ", ".js ", ".scr ", ".com ", ".wsh ", ".hta ", ".pif ", ".cpl"))) or

  descendant of [process where event.action == "start" and process.parent.name : "WinRAR.exe" and
                  process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*" and
                  (process.args : ("* .exe", "* .cmd", "* .bat", "* .vbs", "* .js", "* .scr", "* .com", "* .wsh", "* .hta", "* .pif", "* .cpl") or
                   process.args : (".exe ", ".cmd ", ".bat ", ".vbs ", ".js ", ".scr ", ".com ", ".wsh ", ".hta ", ".pif ", ".cpl "))]
 ) and
 not (process.executable : "?:\\Program Files*\\Microsoft\\Edge\\Application\\*.exe" and
      process.parent.executable : "?:\\Program Files*\\Microsoft\\Edge\\Application\\msedge.exe") and
 not (process.executable : "?:\\Windows\\System32\\conhost.exe" and process.args : "0xffffffff")
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.16.0"