CVE-2025-6218 Google Chronicle · YARA-L

Detect CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation in Google Chronicle

Detects exploitation of CVE-2025-6218, a path traversal vulnerability in RARLAB WinRAR. Attackers can craft malicious archive files that, when extracted, write files outside the intended extraction directory, enabling arbitrary file placement on the victim system. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to code execution, persistence, or privilege escalation by dropping malicious files to sensitive locations such as startup folders, system directories, or application data paths.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2025_6218_winrar_path_traversal {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-6218 WinRAR path traversal exploitation via suspicious file creation in sensitive directories"
    severity = "CRITICAL"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    (
      re.regex($e.principal.process.file.full_path, `(?i)winrar\.exe$`) or
      re.regex($e.principal.process.parent_process.file.full_path, `(?i)winrar\.exe$`)
    )
    (
      re.regex($e.target.file.full_path, `(?i)\\(Startup|System32|SysWOW64|Windows\\Tasks)\\`) or
      re.regex($e.target.file.full_path, `\.\.[\\/]`)
    )

  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L rule for detecting WinRAR path traversal file creation in sensitive Windows directories consistent with CVE-2025-6218.

Data Sources

Google ChronicleEndpoint telemetry via Chronicle forwarder

Required Tables

UDM Events

False Positives & Tuning

  • Scripted deployments that use WinRAR to extract payloads to system paths in controlled environments
  • WinRAR plugin or shell extension activity that creates temp files near system directories
  • Legitimate archiving of files into directories that have names overlapping with sensitive path keywords

Other platforms for CVE-2025-6218

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1WinRAR Path Traversal to Startup Folder

    Expected signal: Sysmon Event ID 11 (FileCreate) with Image=WinRAR.exe and TargetFilename pointing to the Startup folder path

  2. Test 2WinRAR Extraction with Relative Path Traversal Sequence

    Expected signal: Sysmon Event ID 11 with TargetFilename containing path traversal sequence and WinRAR.exe as the initiating process

  3. Test 3WinRAR Drop Executable to Windows Tasks Directory

    Expected signal: Sysmon Event ID 11 (FileCreate) with Image containing WinRAR.exe and TargetFilename matching C:\Windows\Tasks\*

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source archive file that triggered extraction: capture full path, filename, and hash (SHA-256) of the RAR/archive involved.
  2. Determine the destination path(s) where WinRAR wrote files outside the expected extraction directory — focus on startup folders, System32, SysWOW64, Tasks, and any path containing '../'.
  3. Correlate the extraction event with network activity: check if the archive was downloaded from an external source, email attachment, or removable media within the preceding 30 minutes.
  4. Review the file(s) dropped in sensitive paths: hash them, check against threat intel (VirusTotal, internal IOC feeds), and note file type, extension, and whether it's a PE executable or script.

Containment

  1. Immediately isolate the affected host from the network if a malicious file was confirmed dropped in a startup or system directory, to prevent lateral movement or C2 callback.
  2. Quarantine or delete the dropped file(s) from sensitive paths after preserving forensic copies; block the malicious archive by hash at the email gateway and web proxy.

Evidence Collection

  1. Collect Sysmon event logs (Event IDs 1, 11, 23) from the affected host covering the 2-hour window around the extraction event, including process creation, file creation, and file delete events.
  2. Preserve a forensic image or memory dump of the affected system if a malicious executable was dropped, to support malware analysis and identify potential persistence mechanisms.

Escalation Criteria

  • !Escalate to incident response if the dropped file is confirmed malicious (positive AV/sandbox verdict) or if follow-on process execution from the dropped file is detected.
  • !Escalate immediately if the affected host belongs to a privileged tier (domain controller, build server, jump host) or if multiple hosts are observed with similar extraction events, indicating a campaign.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch file for WinRAR.exe at %SystemRoot%\Prefetch\WINRAR.EXE-*.pf — contains execution timestamp and referenced file paths
  • >Windows ShellBags and RecentDocs registry keys recording recently accessed archive files
  • >NTFS $MFT and $LogFile entries for files created in sensitive directories during the extraction window
  • >Zone.Identifier alternate data stream on the source archive, indicating download origin (internet vs. local)

Tuning Guidance

Baseline normal WinRAR extraction patterns in your environment before deploying this detection. Many enterprise tools distribute software via RAR archives to standard paths — create allow-list exceptions for known-good installer hashes and parent process chains (e.g., SCCM, Intune management agents). Tune the sensitive path list to match your organization's highest-risk directories. Consider raising confidence to high only for detections involving executable file types (.exe, .dll, .ps1, .vbs, .bat) dropped in startup or system directories; reduce severity for non-executable file types unless they appear in auto-run locations.

Hunting Queries

Hunt for hosts where WinRAR dropped files across an unusually high number of distinct directory paths, which may indicate automated extraction of a weaponized archive attempting to reach multiple sensitive locations.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessFileName =~ "WinRAR.exe"
| where TimeGenerated > ago(30d)
| summarize FilesDropped=count(), DistinctPaths=dcount(FolderPath), FileList=make_set(FileName, 20) by DeviceName, InitiatingProcessCommandLine
| where DistinctPaths > 3
| order by FilesDropped desc
Hunting — SPL
spl 
index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| eval processName=lower(Image)
| where like(processName, "%winrar.exe")
| stats count AS FilesDropped, dc(TargetFilename) AS DistinctPaths, values(TargetFilename) AS DroppedFiles by host, Image
| where DistinctPaths > 3
| sort -FilesDropped

Atomic Red Team Tests

Test 1 WinRAR Path Traversal to Startup Folder
windows

Creates a crafted RAR archive with a path traversal sequence targeting the current user's startup folder, then extracts it using WinRAR to simulate CVE-2025-6218 exploitation.

Command

powershell 
cd %TEMP% && python -c "
import os, struct
# Create a minimal RAR5 with traversal path payload
# This is a lab simulation — use a real PoC tool in controlled environments
print('Use rarbuild or a CVE-2025-6218 PoC tool to craft a malicious archive with entry path: ..\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe')
" && echo Simulated: WinRAR.exe x malicious.rar %TEMP%\test_extract\

Cleanup

powershell 
del /f "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe" 2>nul & rmdir /s /q %TEMP%\test_extract 2>nul

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with Image=WinRAR.exe and TargetFilename pointing to the Startup folder path

Expected Detection

Alert triggered on RiskIndicator=DropInStartupFolder with InitiatingProcessFileName=WinRAR.exe

Test 2 WinRAR Extraction with Relative Path Traversal Sequence
windows

Simulates detection of a WinRAR extraction where the archive entry name contains '../' sequences, writing a benign file one directory above the extraction target.

Command

powershell 
mkdir %TEMP%\rar_test_src %TEMP%\rar_test_dst && echo harmless > %TEMP%\rar_test_src\test.txt && cd %TEMP%\rar_test_src && WinRAR.exe a -ep %TEMP%\test_traversal.rar .\..\rar_test_src\test.txt && WinRAR.exe x %TEMP%\test_traversal.rar %TEMP%\rar_test_dst\

Cleanup

powershell 
del /f %TEMP%\test_traversal.rar & rmdir /s /q %TEMP%\rar_test_src %TEMP%\rar_test_dst 2>nul

Expected Telemetry

Sysmon Event ID 11 with TargetFilename containing path traversal sequence and WinRAR.exe as the initiating process

Expected Detection

Alert triggered on PathTraversalSuspected RiskIndicator

Test 3 WinRAR Drop Executable to Windows Tasks Directory
windows

Simulates an attacker using a path traversal archive to drop a scheduled task executable into %WINDIR%\Tasks, a known persistence location.

Command

powershell 
echo @echo off > %TEMP%\fake_task.bat && echo echo Simulated task payload >> %TEMP%\fake_task.bat && WinRAR.exe a %TEMP%\task_payload.rar %TEMP%\fake_task.bat && echo Extraction simulation: attacker-controlled RAR would write to C:\Windows\Tasks\ via traversal path in archive entry name

Cleanup

powershell 
del /f %TEMP%\fake_task.bat %TEMP%\task_payload.rar & del /f C:\Windows\Tasks\fake_task.bat 2>nul

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with Image containing WinRAR.exe and TargetFilename matching C:\Windows\Tasks\*

Expected Detection

Alert triggered on RiskIndicator=DropInTasksFolder

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1546.001Change Default File AssociationT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections