WinRAR CVE-2025-8088 — Russia-Aligned Stealer Campaigns

Looks for: WinRAR/Rar/7-Zip writing any file into a Startup folder. Accomplishes: catches the CVE-2025-8088 persistence outcome directly — an extractor has no legitimate reason to write to Startup.

// HUNT: Archive extractor writing into a Startup folder (CVE-2025-8088 persistence)
// MITRE: T1203, T1547.001, T1564.004 | CONF: high  FP: low  COST: low-med
// FP NOTES: none expected; extractors do not legitimately drop Startup items
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| ContextBaseFileName=/^(WinRAR|Rar|UnRAR|7zFM|7z|7zG)\.exe$/i
| TargetFileName=/\\Start Menu\\Programs\\Startup\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: WinRAR/7-Zip as the parent of cmd/PowerShell/mshta/wscript/cscript. Accomplishes: catches the loader kicking off straight from extraction. FP: rare SFX archives launching a setup script — verify the child command line.

// HUNT: Archive extractor spawning a shell or script host
// MITRE: T1203, T1059.001/.003, T1218.005 | CONF: high  FP: low  COST: low
// FP NOTES: rare SFX archives that legitimately launch a setup script
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(WinRAR|Rar|UnRAR|7zFM|7z|7zG)\.exe$/i
| FileName=/^(cmd|powershell|pwsh|powershell_ise|mshta|wscript|cscript|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Looks for: mshta.exe executing a local .hta from a user path. Accomplishes: catches Gamaredon's GammaPhish HTA stage. FP: legacy internal HTA tools — exclude known internal HTA paths.

// HUNT: mshta.exe executing a user-path HTA or spawning a script host
// MITRE: T1218.005, T1059.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: exclude known internal HTA paths; focus on %TEMP%/%APPDATA% and child script hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^mshta\.exe$/i
| CommandLine=/\.hta/i
| CommandLine=/\\(Temp|AppData|Users)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: Windows Script Host executing a .vbs from %TEMP%/%APPDATA%/Startup. Accomplishes: surfaces the GammaLoad VBScript downloader stage. FP: logon scripts / installer VBScript — exclude sanctioned paths.

// HUNT: Windows Script Host running a VBScript from a user-writable path
// MITRE: T1059.005, T1547.001 | CONF: medium  FP: medium  COST: low
// TUNING: exclude sanctioned logon-script + signed-installer paths; favor Startup/AppData + mshta parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.vbs/i
| CommandLine=/\\(Temp|AppData|Roaming|Startup)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: PowerShell command lines with reflective-load / base64 / IEX patterns. Accomplishes: catches the in-memory DLL load staging GIFTEDCROOK. FP: mgmt tooling using encoded commands — require a cmd/explorer/archive parent or same-host Q1 hit.

// HUNT: PowerShell reflective / in-memory load indicators
// MITRE: T1059.001, T1620 | CONF: medium  FP: medium  COST: low-med
// TUNING: require a cmd/explorer/archive parent or same-host Q1 hit; exclude sanctioned automation
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/(FromBase64String|\[Reflection\.Assembly\]|\[System\.Reflection|IEX|Invoke-Expression|-enc(odedcommand)?\b|DownloadString|DownloadData)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: outbound connections initiated directly by wscript/cscript/mshta/powershell. Accomplishes: surfaces stealer exfil and Gamaredon dead-drop resolution. FP: admin scripts calling web services — scope to external dests, correlate with Q3/Q4/Q5.

// HUNT: Outbound network connection initiated by a script host or PowerShell
// MITRE: T1102, T1041 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude RFC1918 + sanctioned destinations; correlate to Q3/Q4/Q5 on same aid
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(wscript|cscript|mshta|powershell|pwsh)\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)