Threat video1:00
CVE-2023-38831 WinRAR Unpatched Installs: Detection & IOCs
Acronis data: on 77% of PCs with a waiting update, that fix closes a KEV-listed flaw. Hunt with 9 detection rules, 26 IOCs and a free Splunk SPL rule.
Read the full threat intel for Unpatched and end-of-support software on Windows endpoints exposes… →
Chapters
- 0:00The hook77% of waiting updates fix exploited flaws.
- 0:04The storyCriminals exploited a WinRAR flaw from April.
- 0:11Attack pathOpening one file runs attacker code.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise17 indicators to hunt: 3 IPs, 4 domains and 2 URLs, and more.
- 0:37MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation5 steps now: Inventory applications on every Windows PC and treat PCs without.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0077% of waiting updates fix exploited flaws.
0:05Criminals exploited a WinRAR flaw from April.
0:08Then state actors joined in.
0:12Opening one file runs attacker code.
0:14Then GuLoader delivers Remcos remote control.
0:17WinRAR shipped a fix in August.
0:25No threat actor is attributed. Confidence: low.
0:3017 indicators to hunt: 3 IPs, 4 domains and 2 URLs, and more.
0:3710 ATT&CK techniques, from initial access to command and control.
0:425 steps now: Inventory applications on every Windows PC and treat PCs without.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.