Archive utilities are trusted tools used every day, but vulnerabilities in archive extraction logic can allow files to be written outside the expected destination. When the resulting path reaches a Windows Startup folder, the impact can include automatic execution after user logon.
The source defines a concise Sysmon hunt for this behavior.
Detection Scenario
The query monitors file-creation events generated by:
WinRAR;
RAR;
7-Zip;
7-Zip GUI components.
It then checks whether the target filename contains a Windows Startup path.
The source associates this behavior with WinRAR path traversal vulnerabilities CVE-2025-8088 and CVE-2025-6218 and analogous archive extraction abuse.
Detection Query
data.win.system.eventID:11 and data.win.eventdata.image:(*\winrar.exe or *\rar.exe or *\7z.exe or *\7zg.exe or *\7zfm.exe) and data.win.eventdata.targetFilename:*\Startup\*
The source recorded zero events during the previous 30 days.
Why Startup Writes Are Important
Writing a file into Startup does not automatically prove malicious intent. However, archive utilities normally extract into locations selected by the user or application.
A direct write into a Startup folder can therefore be unusual, especially when the archive originated from email, a browser download, or another external source.
The Startup directory also has security relevance because files placed there may execute automatically when the user signs in.
Investigation Steps
For any match, review:
the source archive path;
archive filename and hash;
target file written into Startup;
user identity;
process command line;
browser or email activity before extraction;
whether the created file later executed.
If possible, inspect the archive's internal paths to determine whether traversal behavior was involved.
Correlating with Execution
The strongest sequence would combine the file event with later execution of the created file.
For example:
winrar.exe → file created in Startup → user logon → created file executes
This provides more context than the file-write event alone.
Tuning Strategy
Because legitimate software packaging or administrative workflows can occasionally write into Startup directories, environment-specific baselining is still useful.
Exceptions should be tied to known packages, trusted paths, or controlled software-distribution activity.
Operational Value
This is a narrowly scoped detection with no matches in the source period. That makes it suitable for high-priority monitoring in environments where archive tools should never place files into Startup.
It also demonstrates an important hunting principle: combine a legitimate process with an unusual destination rather than treating the process itself as malicious.
