Detection Logic for CVE-2023-38831 WinRAR Exploit

This repository contains a detection logic for CVE-2023-38831 (WinRAR ZIP file spoofing / double-extension exploit) with raw queries / code blocks and ETW-specific provider names + Event IDs. A vulnerable version of WinRAR (< 6.23) on the target system

Behavioral summary

CVE-2023-38831 is exploited when:

User opens a malicious ZIP in WinRAR
The archive contains:

● A decoy file (e.g., invoice.pdf )

● A directory with the same name (e.g., invoice.pdf )

● Inside the directory "two" files with the same name but slightly different names(for one file space and that ends any extension like if 1st file is a "invoice.pdf " then 2nd one may be any script or executable like "invoice.pdf .cmd")
WinRAR executes the script or executable instead of opening the document (“PDF” in this case)
This Execution is triggered via calling the function ShellExecuteExW to execute the file, passing in shExecInfo(ShellExecute via Explorer )
WinRAR spawns a child process (cmd, powershell, mshta, wscript, exe as same as whatever present inside the folder)
Execution often occurs from Temp / AppData / extracted path

Attack summary

Flow Summary User opens archive

  ↓
  
WinRAR shows decoy file

  ↓
  
User double-clicks document

  ↓
  
WinRAR extracts directory with same name
  ↓
  
Executable written to *.pdf\*.pdf .exe
  ↓
  
ShellExecute via Explorer
  ↓
  
ImageLoad of executable

  ↓
  
Payload execution

Why This Flow Matters for Detection

●	No macro usage

●	No process creation dependency

●	Exploit hinges on filesystem masquerading

●	High-confidence, low-noise signal

Important technical details

The files are written in a special structure

Like have two objects (File/Dir) with the same name and when you have a file and a directory with the same name, in an archive file and want to open the file temporarily, by double-clicking on it(target file) in the opened archive file, the Winrar extracts this file for you, Also extracts all files that have the same name as the target file. All of them has wrote in a temporary directory in the %tmp% path.

  	| File/Dir name                                          | Extraction path                                                                   |
  	
  	| ------------------------------------------------------ | --------------------------------------------------------------------------------- |
  	
  	| CLASSIFIED_DOCUMENTS.txt <–target file clicked on it   | `C:\Users\UsersName\AppData\Loca\Temp\Rar$DIa8432.13968\CLASSIFIED_DOCUMENTS.txt\`|
  	
  	| CLASSIFIED_DOCUMENTS.txt .cmd <– the file in directory | `C:\Users\UsersName\AppData\Loca\Temp\Rar$DIa8432.13968\CLASSIFIED_DOCUMENTS.txt\`|

If there are two files in a temporary (decompression) directory with the same name but different sizes (for example, 20k and 12k) and you open the archive and open the first file, 1.txt, which is 20k bytes in size, Winrar will prompt you to replace a file with the second file, 1.txt, which is 10K in size. If you click "Yes," only the second file, 1.txt, will open. This condition can be added for exclusion.

Important point for detection logic

Process execution triggered from a ZIP extraction path or temp directory, with a misleading extension or folder masquerading as a file
When WinRAR releases a file for decompression in the temporary directory, it must contain two files with the same name but slightly different names (space and that ends any extension ), like name as the main file a “ ” (CLASSIFIED_DOCUMENTS.pdf ) at the end of its name and then a “.cmd” (CLASSIFIED_DOCUMENTS.pdf .cmd).
When WinRar loads a DLL and calls the ShellExecuteExA function, the parameter "pExecInfo" has a path with a space and that ends any extension, such as "CLASSIFIED_DOCUMENTS.pdf .cmd."

ETW Providers and Detection Philosophy (ETW-Only) ETW Providers

  	| Purpose                    | ETW Provider                          |
  	
  	| -------------------------- | ------------------------------------- |
  	
  	| Process creation           | `Microsoft-Windows-Kernel-Process`    |
  	
  	| Command line visibility    | `Microsoft-Windows-Security-Auditing` |
  	
  	| File operations (optional) | `Microsoft-Windows-Kernel-File`       |
  	

 Detection will rely on (If No ProcessStart, CreateProcess, or EDR-style parent/child logic):
 
  	●	File system ETW
  	
  	●	Shell / Explorer ETW
  	
  	●	Image load ETW (optional, non-create)
  	
  	●	Command line ETW (optional)
  	
  
 Core ETW Providers
 
  	| Purpose                    | ETW Provider                          |
  	
  	| -------------------------- | ------------------------------------- |
  	
  	| Directory creation         | `Microsoft-Windows-Kernel-File`       |
  	
  	| EXE creation               | `Microsoft-Windows-Kernel-File`       |
  	
  	| Shell execution            | `Microsoft.Windows.ShellExecute`      |
  	
  	| Image load                 | `Microsoft-Windows-Kernel-Image`      |
  	
  	| Explorer                   | `Microsoft-Windows-Explorer`          |
  	
  	| Shell                      | `Microsoft-Windows-Shell-Core`        |

Raw detection logic

At a high level, the logic detects:

			●	WinRAR.exe initiating file writes

			●	Creation of both a directory and a file with the same basename

			●	Executable extension materializing after rename or overwrite

			●	Sequence occurring within a tight time window (<2s)

This pattern is extremely rare in benign workflows but core to the exploit’s execution path.

			●	The rule intentionally avoids:

			●	Command-line inspection

			●	Child process tracking

			●	Full file hashing

Core logic detection

Core logic detection is mentioned below, along with a confidence level and a brief justification.

1.Image Load (Execution Confirmation)

	Reason : This confirms actual execution without process creation telemetry.
	
	Detection Logic :
	
		Windows loader:
		
			●	Maps Invoice.pdf .exe into memory
			
		ETW signal:
		
			●	ImageLoad
			
			●	Image path:
			
			●	*.pdf\*.pdf .exe

2. Detection Rule(API ShellExecuteExA) - High-Fidelity Rule Logic

Generic Detection Rule based on below Telemetry :

			●	File creation events by a WinRar.exe
			
			●	Image load events for WinRar.exe load a DLL Shell32.dll and  start using a API (ShellExecuteExA|W) with the parameters.
			
			●	This function just gets an argument named SHELLEXECUTEINFO, which is a structure.As you see this structure has many fields. but two of them are important for us.
				lpVerb and lpFile.
				
			●	lpVerb - It says that if you set the LpVerb to NULL, ShellExecuteExA|W uses the default verb if available, if not, it performs the “open” verb. And the “open” verb, opens or executes the file.
			
			●	lpFile - The lpFile is the path of the file that is used in ShellExecuteExA to perform the verb and now you can pay attention, the space char(0x20) at the end of the file path.
			             
			
Note: 
	1- Shell32.dll: This is where ShellExecuteExA is defined. It contains the logic to parse the SHELLEXECUTEINFO structure and determine how to handle the request (e.g., opening a document, running an EXE, or showing a properties dialog)
			
	2-  way, the vulnerability works : The vulnerability is here. Winrar removed space from the file name at write time but forgot to commit this change to the extraction list. So the target file name didn’t change and the space is still in the file name.
		also i can say the ShellExecuteExA opens the “CLASSIFIED_DOCUMENTS.pdf .cmd” file. the “.cmd” doesn’t matter for ShellExecuteExA and it just runs a file with the “CLASSIFIED_DOCUMENTS.pdf ” name in that path.
        			
Detection Logic  (High-Fidelity Rule Logic):

	●	SQL-Based :\\Detection_Logic\\SQL-based-ShellExecute.txt
	
	●	KQL (ProcessCommandLine):\\Detection_Logic\\KQL-API-ProcessCommandLine.txt
	
	●	Pseudocode Detection Logic :\\Detection_Logic\\SQL-API-ShellExecute.txt

Note:- You can create a detection logic by according to the above standards.I'm also adding a simple Python script to obtain events that will help in your detection rule writing.also added which usefull while creating ETW based rule.

	 
		| Provider                              | Event ID                                  | Event ID / Task             |
		                                                                       
		| ------------------------------------- | ----------------------------------------- | --------------------------- |
		                                                                       
		| `Microsoft-Windows-Shell-Core`        | {30336983-0362-4540-9E69-14844E6A3B7A}    | Event ID 1 (Execute)        |
		
		| `Microsoft-Windows-Kernel-Process`    | {22FB2AD3-E163-4078-8C2A-801648437D2D}    | Image Load / Process Start  |

3. High-Fidelity Rule Logic for WinRAR CVE-2023-38831 Exploitation

	- Reason:Alert when an executable is created or loaded from a directory whose name ends with a document extension, and execution is initiated via Explorer/Shell APIs.			
	- Pseudocode Detection Logic (High-Fidelity Rule Logic)- \\Detection_Logic\\WinRAR-CVE-2023-38831-Exploitation.txt

4. EDR Detection Rule(ETW-based)

	Generic EDR Detection Rule based on below Telemetry :	 
	
			●	File creation events
			
			●	Shell execution / Explorer invocation
			
			●	Image load events (optional but strong)
			
	Detection Logic : \\Detection_Logic\\EDR-Detection-ETW-based.txt

5. KQL Query without DeviceProcessEvents(If Endpoint suport)

		Reason: As This version works without relying on DeviceProcessEvents 
		
		Detection Logic : \\Detection_Logic\\KQL-Detection-without-DeviceProcessEvents.txt

6. Shell Execution Signal (If Enabled and supported)

		Reason : This strengthens confidence when correlated with file creation.
		
		Detection Logic : \\Detection_Logic\\Shell-Execution-Signal.txt

7. SOC-Friendly(Triage Flow)

		Reason : This rule was created for every step discovered during an attack.
		
		Detection Logic : \\Detection_Logic\\SOC-Friendly.txt

Alternative detection logic

(Alert / If included ProcessStart, CreateProcess, or EDR-style parent/child logic)

1.Detect when winrar.exe Createed a suspicious dir / file, especially from temp or archive extraction paths and run a Suspect created file using vulnerable version of WinRAR

Reason:Create rules depending on the events that your product handles, such as access, event, or cloud-based 

Detection Logic:\\Detection_Logic\\Gen-Pseudocode-Detection-Logic.txt

2.Detect when winrar.exe spawns a suspicious child process, especially from temp or archive extraction paths

	Detection Logic :
	
		EndPonit : \\Detection_Logic\\winrar-spawns-suspicious-child-process.txt
		
		Sigma Rule : \\Detection_Logic\\Sigma-Rule-WinRAR Exploit.txt

3. Alert based on ETW Provider (Process Creation)

		| Provider                              | Event ID                    |
		
		| ------------------------------------- | --------------------------- |
		
		| `Microsoft-Windows-Security-Auditing` | 4688 (Process Creation)     |
		

	Detection Logic
	
		●	Parent Process = winrar.exe
		
		●	New Process = scripting engine or executable
		
		●	CommandLine includes Temp/AppData

4. KQL Query with DeviceProcessEvents(If Endpoint suport)

		Reason: If we want to develope wusing DeviceProcessEvents 
		
		Detection Logic : \\Detection_Logic\\KQL-Detection-with-DeviceProcessEvents.txt

5. Indicator of Attack( you can add a High-confidence Alert)

	By committing to the conditions below, you can add an IOA or watch-list rule for alerting.

	| Indicator                          | Confidence |
	
	| ---------------------------------- | ---------- |
	
	| winrar.exe spawning cmd/powershell |  High     |
	
	| Execution from Temp/AppData        |  High     |
	
	| `.cmd/.bat /.exe ` execution       |  High     |
	
	| Double-extension ZIP opened        |  Medium   |

Watchlist

Create a watchlist for two files with the same name in a directory created by a vulnerable version of WinRAR (< 6.23) :

AS you can’t have two files with the same name in a directory. also, you can’t have a directory and a file with the same name.

But this is possible in compression software like WinRar/7zip. In a compressed file, no matter whether you have files with the same name, the files are written in a special structure.

So you can have two objects (File/Dir) with the same name in a ZIP/RAR file.

Exclusions ( Legitimate triggers )

	Likely legitimate triggers
	
		●	cmd.exe spawned by 7-Zip/WinRAR self-extracting installers
		
		●	powershell.exe launched by enterprise software updaters packaged in RAR
		
		●	rundll32.exe used by printer driver or GPU driver installers

	Exclusion logic (example)
	
		AND NOT (
		  ChildImage IN (cmd.exe, powershell.exe, rundll32.exe)
		  AND
		  CommandLine CONTAINS (
			"setup.exe",
			"install.cmd",
			"driverinstall",
			"vendorupdate"
		  )
		)

Correlation Opportunity

	This preserves exploit detection while suppressing known installer behavior.
	Archive file telemetry (file-system events) — Correlating this rule with RAR/ZIP extraction activity (e.g., file creation of .cmd/.bat/.exe immediately before execution, especially from WinRAR extraction directories like Rar$EX*) would significantly increase confidence and reduce false positives by proving execution directly followed archive extraction.

MITRE ATT&CK Mapping

	T1204.002 – User Execution: Malicious File
	T1059 – Command and Scripting Interpreter
	T1036 – Masquerading (double extension)

Disclaimer

This detection code is for educational and authorized testing purposes only.  
Do not use it on systems you do not own or have explicit permission to test.

Most Popular

CVE-2023-38831