CVE-2023-40477 Potential Exploitation - WinRAR Application Crash

Status: test
Severity: medium
Log source: product windows, service application
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

Known false positives

Legitimate crash for reasons other than exploitation of the vulnerability

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique

Telemetry coverage

Provider	Record / event type
Application-Error	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.

Rule body

title: CVE-2023-40477 Potential Exploitation - WinRAR Application Crash
id: e5a29b54-6fe7-4258-8a23-82960e31231a
status: test
description: Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477
references:
    - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
    - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
    - https://www.rarlab.com/vuln_rev3_names.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-31
tags:
    - attack.execution
    - cve.2023-40477
    - detection.emerging-threats
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'Application Error'
        EventID: 1000
        AppName: 'WinRAR.exe'
    filter_main_fixed_version:
        # TODO: fix this when the "lt" modifier is implemented for software versions
        AppVersion|startswith:
            - '6.23.'
            - '6.24.'
            - '6.25.'
            - '6.26.'
            - '7.'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate crash for reasons other than exploitation of the vulnerability
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Provider_Name: 'Application Error'
    EventID: 1000
    AppName: 'WinRAR.exe'

Stage 2: `not filter_main_fixed_version`

filter_main_fixed_version:
    AppVersion|startswith:
        - '6.23.'
        - '6.24.'
        - '6.25.'
        - '6.26.'
        - '7.'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`AppVersion`	starts_with	`6.23.`	`excludes:AppVersion` `field:"AppVersion" value:"6.23."`
`AppVersion`	starts_with	`6.24.`	`excludes:AppVersion` `field:"AppVersion" value:"6.24."`
`AppVersion`	starts_with	`6.25.`	`excludes:AppVersion` `field:"AppVersion" value:"6.25."`
`AppVersion`	starts_with	`6.26.`	`excludes:AppVersion` `field:"AppVersion" value:"6.26."`
`AppVersion`	starts_with	`7.`	`excludes:AppVersion` `field:"AppVersion" value:"7."`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AppName`	eq	`WinRAR.exe`	`field:"AppName" kind:eq value:"WinRAR.exe"`
`Provider_Name`	eq	`Application Error` corpus 5 (sigma 5)	`field:"Provider_Name" kind:eq value:"Application Error"`