Detection rules › Sigma
WinRAR Execution in Non-Standard Folder
Detects a suspicious WinRAR execution in a folder which is not the default installation folder
Known false positives
- Legitimate use of WinRAR in a folder of a software that bundles WinRAR
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: WinRAR Execution in Non-Standard Folder
id: 4ede543c-e098-43d9-a28f-dd784a13132f
status: test
description: Detects a suspicious WinRAR execution in a folder which is not the default installation folder
references:
- https://twitter.com/cyb3rops/status/1460978167628406785
author: Florian Roth (Nextron Systems), Tigzy
date: 2021-11-17
modified: 2025-07-16
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- '\rar.exe'
- '\winrar.exe'
- Description:
- 'Command line RAR'
- 'WinRAR'
filter_main_unrar:
# Note: we filter unrar as it has the same description as the other utilities, and we're only interested in compression
Image|endswith: '\UnRAR.exe'
filter_main_path:
Image|contains:
- ':\Program Files (x86)\WinRAR\'
- ':\Program Files\WinRAR\'
filter_optional_temp:
# Note: in some occasion installers were seen dropping "rar" in TEMP
Image|contains: ':\Windows\Temp\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate use of WinRAR in a folder of a software that bundles WinRAR
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
- Image|endswith:
- '\rar.exe'
- '\winrar.exe'
- Description:
- 'Command line RAR'
- 'WinRAR'
Stage 2: not filter_main_*
filter_main_unrar:
Image|endswith: '\UnRAR.exe'
filter_main_path:
Image|contains:
- ':\Program Files (x86)\WinRAR\'
- ':\Program Files\WinRAR\'
Stage 3: not filter_optional_temp
filter_optional_temp:
Image|contains: ':\Windows\Temp\'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \UnRAR.exe | excludes:Image field:"Image" value:"\UnRAR.exe" |
Image | match | :\Program Files (x86)\WinRAR\ | excludes:Image field:"Image" value:":\Program Files (x86)\WinRAR\" |
Image | match | :\Program Files\WinRAR\ | excludes:Image field:"Image" value:":\Program Files\WinRAR\" |
Image | match | :\Windows\Temp\ | excludes:Image field:"Image" value:":\Windows\Temp\" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Description | eq |
| field:"Description" kind:eq |
Image | ends_with |
| field:"Image" kind:ends_with |