CVE-2023-40477 Potential Exploitation - .REV File Creation

Status: test
Severity: low
Log source: category file_event, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

Known false positives

Legitimate extraction of multipart or recovery volumes ZIP files

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: CVE-2023-40477 Potential Exploitation - .REV File Creation
id: c3bd6c55-d495-4c34-918e-e03e8828c074
status: test
description: Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.
references:
    - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
    - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
    - https://www.rarlab.com/vuln_rev3_names.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-31
tags:
    - attack.execution
    - cve.2023-40477
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\explorer.exe' # When extracted via context menu
            - '\WinRAR.exe'
        TargetFilename|endswith: '.rev'
    condition: selection
falsepositives:
    - Legitimate extraction of multipart or recovery volumes ZIP files
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '\explorer.exe'
        - '\WinRAR.exe'
    TargetFilename|endswith: '.rev'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\WinRAR.exe` corpus 6 (sigma 6) `\explorer.exe` corpus 13 (sigma 13)	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.rev`	`field:"TargetFilename" kind:ends_with value:".rev"`