winrar-cve-2018-20250-ace-files

Description

This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'. The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension. Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250

Query · kql

//Query for .ace files
DeviceFileEvents
| where Timestamp > ago(7d)
//Look for ACE files
| where FileName endswith ".ace"
//Exclude clean ACE files used by Trend Micro
| where FolderPath !contains @'\Trend Micro'
Raw source winrar-cve-2018-20250-ace-files · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8320de94-2411-4748-9329-e1543f257323
name: winrar-cve-2018-20250-ace-files
description: |
  This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
  WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
  The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension.
  Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Execution
- Lateral movement
- Impact
query: |
  //Query for .ace files
  DeviceFileEvents
  | where Timestamp > ago(7d)
  //Look for ACE files
  | where FileName endswith ".ace"
  //Exclude clean ACE files used by Trend Micro
  | where FolderPath !contains @'\Trend Micro'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.