Attachment: WinRAR CVE-2025-8088 exploitation

 1name: "Attachment: WinRAR CVE-2025-8088 exploitation"
 2description: |
 3    Detects attempts to exploit CVE-2025-8088 via attached RAR files
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          // its a rar file
10          (
11            .content_type == "application/x-rar-compressed"
12            or .file_extension == "rar"
13            or .file_type == "rar"
14          )
15          // less than 10 meg
16          and .size < 10000000
17          // explode it
18          and any(file.explode(.),
19                  // contains a yara match
20                  any(.scan.yara.matches, .name == "WinRAR_CVE_2025_8088")
21          )
22  )  
23attack_types:
24  - "Malware/Ransomware"
25tactics_and_techniques:
26  - "Exploit"
27  - "Evasion"
28detection_methods:
29  - "Archive analysis"
30  - "File analysis"
31  - "YARA"
32id: "33b3a82b-0721-53b8-a5f2-d28e3d791b60"