← Back to SOC feed Coverage →

Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218

yara HIGH signature-base
exploitflorian-roth
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-08-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis identifies adversaries exploiting RAR archive vulnerabilities to execute path traversal attacks that enable unauthorized file access or code execution, mirroring the mechanics of recent CVEs such as 2025-8088 and 2025-6218. Proactive hunting in Azure Sentinel is critical because these sophisticated extraction flaws often bypass standard perimeter defenses, requiring deep inspection of archive processing logs to detect lateral movement or data exfiltration before an incident escalates.

YARA Rule

rule EXPL_RAR_Archive_with_Path_Traversal_Aug25 {
   meta:
      description = "Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218"
      reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088"
      author = "Arnim Rupp (Nextron Systems)"
      date = "2025-08-11"
      score = 70
      hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3"
      hash = "dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab"
      hash = "107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806"
      id = "641c7e18-a887-5367-8584-2dc41c7ead53"
   strings:
      // Only look for the users Autostart folder because the most effective attack method
      // Use \ and / to handle archives created on Windows and Linux
      $s1 = "..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
      $s2 = "..//../AppData/Roaming/Microsoft/Windows/Start Menu"
      // CVE-2025-6218:
      $s3 = "/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"    
   condition:
      1 of ( $s* )
      and (
        uint16(0) == 0x4B50         // Yes, Winrar can chocke on ZIPs
        or int32(0) == 0x21726152   // RAR
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the RAR Path Traversal detection rule, including targeted filters and exclusions:

Original source: https://github.com/Neo23x0/signature-base/blob/main/yara/exploit_rar_archive_with_path_traversal_aug25.yar