Silent Lynx Targets CIS Governments with Weaponized WinRAR Archives — Detection and Remediation Guide for SOC Teams

---
title: Office Application Spawning Script Interpreter - Silent Lynx Macro Chain
id: 8c2e4b61-3f7a-4d9e-b1c5-6a8d2e4f7b90
status: experimental
description: Detects Microsoft Office applications spawning PowerShell, cmd, wscript, or mshta, consistent with Silent Lynx macro-enabled document infection chains observed against CIS government targets.
references:
  - https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins or document automation; investigate any hit in environments without approved macro workflows
level: high
---
title: WinRAR or Archive Utility Writing to Startup or Persistence Locations
id: 3d7f9a24-8b1c-4e6d-a2f8-9c4e6b1d5a73
status: experimental
description: Detects WinRAR or common archive extraction utilities writing executable or script content to Startup folders, Run-key-watched directories, or other persistence locations, consistent with crafted archive exploitation observed in the Silent Lynx campaign.
references:
  - https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith:
      - '\winrar.exe'
      - '\rar.exe'
      - '\unrar.exe'
  selection_target:
    TargetFilename|contains:
      - '\Start Menu\Programs\Startup\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
  selection_extension:
    TargetFilename|endswith:
      - '.exe'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
      - '.js'
      - '.lnk'
      - '.dll'
      - '.hta'
  condition: selection_source and selection_target and selection_extension
falsepositives:
  - Users intentionally extracting shortcuts to Startup; verify file hash, source archive, and signer
level: critical
---
title: Suspicious Process Downloading from GitHub Raw Content
id: 6b1d8e53-2a4f-4c7b-9e3d-5f8a1c4b7d62
status: experimental
description: Detects Office applications, archive utilities, or uncommon executables making network connections to GitHub raw content endpoints, consistent with Silent Lynx staging PowerShell payloads on GitHub infrastructure.
references:
  - https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html
  - https://attack.mitre.org/techniques/T1102/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'raw.githubusercontent.com'
      - 'gist.githubusercontent.com'
  selection_process:
    Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\winrar.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_domain and selection_process
falsepositives:
  - PowerShell itself pulling modules from GitHub is common in dev environments; the flagged parent processes are not
level: high

let Lookback = 7d;
let ScriptInterpreters = dynamic(["powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe"]);
let OfficeOrArchive = dynamic(["winword.exe","excel.exe","powerpnt.exe","outlook.exe","winrar.exe","rar.exe","unrar.exe"]);
// Stage 1: Office or archive utility spawning a script interpreter
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (OfficeOrArchive)
| where FileName in~ (ScriptInterpreters)
| project ChildTime=TimeGenerated, DeviceName, AccountName, ParentProcess=InitiatingProcessFileName, ChildProcess=FileName, ChildCommandLine=ProcessCommandLine, ChildSHA256=SHA256, DeviceId;
// Stage 2: Files dropped by archive utilities into Startup folders
let PersistenceDrops = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("winrar.exe","rar.exe","unrar.exe")
| where FolderPath has "Startup"
| where FileName endswith ".exe" or FileName endswith ".bat" or FileName endswith ".ps1" or FileName endswith ".vbs" or FileName endswith ".js" or FileName endswith ".lnk" or FileName endswith ".hta"
| project DropTime=TimeGenerated, DeviceName, DroppedFile=FileName, DropPath=FolderPath, DroppedBy=InitiatingProcessFileName, DeviceId;
// Stage 3: Unusual processes egressing to GitHub staging infrastructure
let GitHubStaging = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any ("raw.githubusercontent.com","gist.githubusercontent.com")
| where InitiatingProcessFileName in~ (OfficeOrArchive) or InitiatingProcessFileName in~ (ScriptInterpreters)
| project NetTime=TimeGenerated, DeviceName, EgressProcess=InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, DeviceId;
SuspiciousChildren
| join kind=leftouter PersistenceDrops on DeviceId
| join kind=leftouter GitHubStaging on DeviceId
| project-reorder DeviceName, AccountName, ChildTime, ParentProcess, ChildProcess, ChildCommandLine, DroppedFile, DropPath, RemoteUrl, RemoteIP
| sort by ChildTime desc

-- Silent Lynx hunt: Startup-folder payloads and suspicious process lineage
LET startup_drops = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/*')
WHERE (FullPath =~ '\.(exe|bat|cmd|ps1|vbs|js|lnk|hta|dll)$')
  AND Mtime > now() - (30 * 24 * 3600)

LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|pwsh|wscript|cscript|mshta|rundll32)'
  AND (CommandLine =~ '(?i)(githubusercontent|gist\.)'
       OR Exe =~ '(?i)(startup|temp|appdata\\roaming)')

SELECT * FROM startup_drops
UNION ALL
SELECT * FROM suspicious_procs

# Silent Lynx exposure assessment - run as Administrator
# 1. Inventory WinRAR installations and flag outdated versions
$winrarPaths = @(
    "$env:ProgramFiles\WinRAR\WinRAR.exe",
    "${env:ProgramFiles(x86)}\WinRAR\WinRAR.exe"
)
foreach ($p in $winrarPaths) {
    if (Test-Path $p) {
        $v = (Get-Item $p).VersionInfo.FileVersion
        Write-Host "[FOUND] WinRAR at $p - Version $v"
        Write-Host "[ACTION] Verify this is the latest release from https://www.rarlab.com/download.htm - WinRAR does not auto-update"
    }
}
# Also check per-user installs
Get-ChildItem "C:\Users\*\AppData\Local\WinRAR\WinRAR.exe" -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "[FOUND] Per-user WinRAR: $($_.FullName) - $($_.VersionInfo.FileVersion)"
}

# 2. Flag executable/script content written to Startup folders in the last 30 days
$cutoff = (Get-Date).AddDays(-30)
Get-ChildItem "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" -ErrorAction SilentlyContinue |
    Where-Object { $_.Extension -match '\.(exe|bat|cmd|ps1|vbs|js|lnk|hta|dll)$' -and $_.LastWriteTime -gt $cutoff } |
    ForEach-Object { Write-Host "[ALERT] Recent Startup artifact: $($_.FullName) - Modified $($_.LastWriteTime)" }

# 3. Verify Office macro policy (block macros from the internet) via registry
$officeVersions = @("15.0","16.0")
foreach ($ver in $officeVersions) {
    foreach ($app in @("Word","Excel","PowerPoint")) {
        $key = "HKCU:\Software\Policies\Microsoft\Office\$ver\$app\Security"
        if (Test-Path $key) {
            $val = (Get-ItemProperty $key -Name blockcontentexecutionfrominternet -ErrorAction SilentlyContinue).blockcontentexecutionfrominternet
            Write-Host "[$app $ver] blockcontentexecutionfrominternet = $val (1 = macros blocked from MOTW files)"
        } else {
            Write-Host "[$app $ver] No macro policy key found - recommend setting via GPO"
        }
    }
}

# 4. Verify PowerShell Script Block Logging and Module Logging are enabled
$sbl = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue
if ($sbl.EnableScriptBlockLogging -eq 1) {
    Write-Host "[OK] PowerShell Script Block Logging enabled"
} else {
    Write-Host "[GAP] Enable Script Block Logging via GPO: Computer Config > Admin Templates > Windows Components > Windows PowerShell"
}

# 5. Audit recent network connections to GitHub content hosts from unusual parents (last 24h netstat snapshot)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -eq 443 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.ProcessName -match 'winword|excel|powerpnt|winrar|wscript|cscript|mshta') {
            Write-Host "[ALERT] Unusual egress process: $($proc.ProcessName) (PID $($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort)"
        }
    }