Detect CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation in Splunk
Detects exploitation of CVE-2025-6218, a path traversal vulnerability in RARLAB WinRAR. Attackers can craft malicious archive files that, when extracted, write files outside the intended extraction directory, enabling arbitrary file placement on the victim system. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to code execution, persistence, or privilege escalation by dropping malicious files to sensitive locations such as startup folders, system directories, or application data paths.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
SPL Detection Query
index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| eval processName=lower(Image)
| where like(processName, "%winrar.exe") OR like(lower(ParentImage), "%winrar.exe")
| eval targetPath=lower(TargetFilename)
| where match(targetPath, "(?i)(\\\\startup\\\\|\\\\system32\\\\|\\\\syswow64\\\\|\\\\windows\\\\tasks\\\\|\\\\programdata\\\\microsoft\\\\)")
OR match(TargetFilename, "(?i)\.\.[/\\\\]")
| eval RiskIndicator=case(
match(targetPath, "startup"), "DropInStartupFolder",
match(targetPath, "system32"), "DropInSystem32",
match(targetPath, "syswow64"), "DropInSysWOW64",
match(targetPath, "\\\\tasks\\\\"), "DropInTasksFolder",
1==1, "PathTraversalSuspected"
)
| table _time, host, Image, ParentImage, TargetFilename, RiskIndicator, User
| sort -_timeDetects Sysmon file creation events where WinRAR writes files to sensitive Windows directories, indicating CVE-2025-6218 path traversal exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate installers bundled as RAR archives extracting to expected system paths
- Enterprise software deployments using WinRAR for distribution to system directories
- WinRAR self-update processes writing to program files directories
Other platforms for CVE-2025-6218
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WinRAR Path Traversal to Startup Folder
Expected signal: Sysmon Event ID 11 (FileCreate) with Image=WinRAR.exe and TargetFilename pointing to the Startup folder path
- Test 2WinRAR Extraction with Relative Path Traversal Sequence
Expected signal: Sysmon Event ID 11 with TargetFilename containing path traversal sequence and WinRAR.exe as the initiating process
- Test 3WinRAR Drop Executable to Windows Tasks Directory
Expected signal: Sysmon Event ID 11 (FileCreate) with Image containing WinRAR.exe and TargetFilename matching C:\Windows\Tasks\*
Unlock Pro Content
Get the full detection package for CVE-2025-6218 including response playbook, investigation guide, and atomic red team tests.