Sigma Rule Library

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

View on GitHubOpen raw file

Detection logic

selection

Image|endswith: \WinRAR.exe
TargetFilename|contains: \AppData\Local\Temp\Rar$
TargetFilename|re: \.[a-zA-Z0-9]{1,4} \.

Condition

selection

Raw YAML

title: CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
id: e4556676-fc5c-4e95-8c39-5ef27791541f
related:
    - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
      type: similar
status: test
description: Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331
references:
    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
    - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-30
tags:
    - attack.execution
    - cve.2023-38331
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\WinRAR.exe'
        TargetFilename|contains: '\AppData\Local\Temp\Rar$'
        TargetFilename|re: '\.[a-zA-Z0-9]{1,4} \.'
    condition: selection
falsepositives:
    - Unknown
level: high

False positives

  • Unknown

References

Related rules

Similar rules

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

critical

windows · Same logsource category (file_event)

CVE-2021-26858 Exchange Exploitation

high

windows · Same logsource category (file_event)

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

critical

windows · Same logsource category (file_event)

CVE-2021-44077 POC Default Dropped File

high

windows · Same logsource category (file_event)