← Back to SOC feed Coverage →

Generic rule for hostile ACE archive using CVE-2018-20250

yara LOW Yara-Rules
communityexploit
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-06T23:00:00Z · Confidence: medium

Hunt Hypothesis

An adversary may be leveraging CVE-2018-20250 to exploit a malicious ACE archive and execute arbitrary code on a system. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential exploitation of this known vulnerability before it leads to a compromise.

YARA Rule

rule CVE_2018_20250 : AceArchive UNACEV2_DLL_EXP
{
    meta:
        description = "Generic rule for hostile ACE archive using CVE-2018-20250"
        author = "xylitol@temari.fr"
        date = "2019-03-17"
        reference = "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
        // May only the challenge guide you
    strings:
        $string1 = "**ACE**" ascii wide
        $string2 = "*UNREGISTERED VERSION*" ascii wide
        // $hexstring1 = C:\C:\
        $hexstring1 = {?? 3A 5C ?? 3A 5C}
        // $hexstring2 = C:\C:C:..
        $hexstring2 = {?? 3A 5C ?? 3A ?? 3A 2E}
    condition:  
         $string1 at 7 and $string2 at 31 and 1 of ($hexstring*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/cve_rules/CVE-2018-20250.yar