Скачать или смотреть IR - SOC221 - Possible WinRAR Zero-Day Activity

Continuing with the Incident Responder Path, we tackle an CRITICAL alert for an "SOC221 - Possible WinRAR Zero-Day Activity". Was this a Red Team test, a misconfiguration, a false positive or possibly something more malicious?

EventID: 181
Event Time: Aug, 31, 2023, 01:37 PM
Rule: SOC221 - Possible WinRAR Zero-Day Activity
Level: Incident Responder
Hostname: Audrey
IP Address: 172.16.17.59
Affected User: Audrey
Alert Trigger Reason: Executable file or script detected in Rar archives
Alert Trigger Command: C:\Windows\system32\cmd.exe /c ""C:\Users\LETSDE~1\AppData\Local\Temp\1\Rar$DIa8052.4535\DEFCON2023.png .cmd\
L1 Note: When I examined the alert, I saw that DEFCON2023.rar was downloaded from Email, but I could not detect whether the DEFCON2023.rar was extracted or not.


Files:
https://www.virustotal.com/gui/file/6...
https://www.virustotal.com/gui/file/9...
https://www.virustotal.com/gui/file/9...

NOTES:
https://www.group-ib.com/blog/cve-202...
https://blog.google/threat-analysis-g...