CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
Source: github.com/SigmaHQ/sigma

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
related:
    - id: e4556676-fc5c-4e95-8c39-5ef27791541f
      type: similar
status: test
description: Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.
references:
    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
    - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
author: Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
date: 2023-08-30
modified: 2024-01-22
tags:
    - detection.emerging-threats
    - attack.execution
    - attack.t1203
    - cve.2023-38331
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\WinRAR.exe'
    selection_folder:
        CommandLine|contains: '\AppData\Local\Temp\Rar$'
    selection_double_ext:
        CommandLine|re: '\.[a-zA-Z0-9]{1,4} \.'
    selection_binaries:
        # Note: add additional binaries that the attacker might use
        - Image|endswith:
              - '\cmd.exe'
              - '\cscript.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\wscript.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'cscript.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'wscript.exe'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\WinRAR.exe'

Stage 2: `selection_folder`

selection_folder:
    CommandLine|contains: '\AppData\Local\Temp\Rar$'

Stage 3: `selection_double_ext`

selection_double_ext:
    CommandLine|re: '\.[a-zA-Z0-9]{1,4} \.'

Stage 4: `selection_binaries`

selection_binaries:
    - Image|endswith:
          - '\cmd.exe'
          - '\cscript.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\wscript.exe'
    - OriginalFileName:
          - 'Cmd.Exe'
          - 'cscript.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
          - 'wscript.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\AppData\Local\Temp\Rar$`	`field:"CommandLine" kind:match value:"\AppData\Local\Temp\Rar$"`
`CommandLine`	regex_match	`.[a-zA-Z0-9]{1,4} .`	`field:"CommandLine" kind:regex_match value:".[a-zA-Z0-9]{1,4} ."`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\cscript.exe` corpus 72 (sigma 72) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\wscript.exe` corpus 74 (sigma 74)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`Cmd.Exe` corpus 81 (sigma 43, elastic 21, splunk 17) `PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `cscript.exe` corpus 32 (sigma 17, elastic 15) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3) `wscript.exe` corpus 38 (elastic 21, sigma 17)	`field:"OriginalFileName" kind:eq`
`ParentImage`	ends_with	`\WinRAR.exe` corpus 5 (sigma 5)	`field:"ParentImage" kind:ends_with value:"\WinRAR.exe"`