Potential WinRAR CVE-2023-38831 Exploitation

[rule]
description = """
Identifies suspicious child processes of the WinRAR process. This may indicate the successful exploitation of the WinRAR
vulnerability CVE-2023-38831.
"""
id = "1a3b0389-eeb3-46f6-a304-e1983a4dae09"
license = "Elastic License v2"
name = "Potential WinRAR CVE-2023-38831 Exploitation"
os_list = ["windows"]
reference = [
    "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
    "https://github.com/b1tg/CVE-2023-38831-winrar-exploit/tree/main",
]
version = "1.0.5"

query = '''
sequence with maxspan=10s
 [file where event.action == "creation" and process.name : "WinRAR.exe" and
  file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*" and
  not file.extension :  ("exe", "cmd", "bat ", "vbs", "js", "scr ", "com", "wsh", "hta", "pif", "cpl")] by process.entity_id as event0
 [file where event.action == "creation" and process.name : "WinRAR.exe" and
  file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*" and
  file.extension :  ("exe", "cmd", "bat ", "vbs", "js", "scr ", "com", "wsh", "hta", "pif", "cpl") and
  startswith~(file.name, concat(event0.file.name, " "))] by process.entity_id
 [process where event.action == "start" and
  process.parent.name : "winrar.exe" and process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*"] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.4.0"