detect-malicious-rar-extraction

id: dac6bcd8-35c9-4937-88e8-3b1c00dcebe2
name: detect-malicious-rar-extraction
description: |
  This query was originally published in the threat analytics report, CVE-2018-15982 exploit attacks.
  CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary code. It has since been patched.
  Actors have been observed using this vulnerability in targeted attacks. Exploits for CVE-2018-15982 have also been included in several exploit kits.
  In some initial attacks exploiting CVE-2018-15982, attackers sent targets spear-phishing emails. The emails would include an attached RAR archive, which contained a lure document, as well as a second archive disguised as a .jpg file. Opening the document would automatically run an embedded Flash ActiveX control. This, in turn, would call a script containing the exploit. The exploit's ability to run arbitrary code would be employed to unpack and run a payload from the second archive. The payload is a backdoor used both to achieve persistance and for command and control.
  The following query detects possible instances of a payload being extracted by the exploit.
  References:
  https://nvd.nist.gov/vuln/detail/CVE-2018-15982
  https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Initial access
- Execution
- Persistence
- Command and control
query: |
  DeviceProcessEvents
  | where FileName == "cmd.exe"
  | where ProcessCommandLine contains @"set path=%ProgramFiles(x86)%\WinRAR;C:\Program Files\WinRAR;"
  | where ProcessCommandLine contains @"cd /d %~dp0 & rar.exe e -o+ -r -inul*.rar"