winrar-cve-2018-20250-file-creation

Description

This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'. The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder. Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250

Query · kql

//Query for WinRAR file creation in the Startup folder
DeviceFileEvents
| where Timestamp > ago(7d)
//Look for WinRAR as the initiating process or a commandline that has ".rar" 
| where (InitiatingProcessFileName =~ "winrar.exe" 
or InitiatingProcessCommandLine contains ".rar") 
//Check for the file in the Startup folder
and FolderPath contains "Programs\\Startup"
Raw source winrar-cve-2018-20250-file-creation · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 04eaf822-d364-4434-b2c8-a6378d97f192
name: winrar-cve-2018-20250-file-creation
description: |
  This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
  WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
  The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder.
  Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Execution
- Lateral movement
- Impact
query: |
  //Query for WinRAR file creation in the Startup folder
  DeviceFileEvents
  | where Timestamp > ago(7d)
  //Look for WinRAR as the initiating process or a commandline that has ".rar" 
  | where (InitiatingProcessFileName =~ "winrar.exe" 
  or InitiatingProcessCommandLine contains ".rar") 
  //Check for the file in the Startup folder
  and FolderPath contains "Programs\\Startup"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.