Adversary Use of RAR and PowerShell Downloads for Tooling Delivery

Adversaries, notably the FIN7 group, frequently employ the technique of downloading secondary payloads via RAR archives or PowerShell scripts from the internet to evade detection. By leveraging these formats, attackers can obfuscate or encrypt their command-and-control (C2) tools, preventing security appliances from performing immediate payload inspection. This activity often occurs following initial system access, as the downloaded tools are used to expand the adversary's footprint, conduct further reconnaissance, or facilitate lateral movement within the target environment. Because these file types are frequently used in administrative or update workflows, defenders must tune detection logic to distinguish between legitimate software management traffic and unauthorized ingress tool transfer.

Attack Chain

1. Attacker gains initial access to an internal workstation or server via spearphishing or exploit.
2. Attacker initiates an outbound connection to an adversary-controlled server on the internet.
3. Attacker triggers a request for a malicious RAR archive or a PowerShell script (.ps1).
4. The internal host downloads the payload through the enterprise network gateway or firewall.
5. The file is extracted or executed by the attacker using native utilities (e.g., PowerShell or rar.exe).
6. The secondary payload establishes a C2 channel or deploys additional modules (e.g., infostealers, backdoors).
7. Attacker proceeds to conduct lateral movement or data exfiltration from the compromised host.

Impact

Successful execution of this technique allows adversaries to bypass traditional perimeter security controls and deliver specialized malware. The impact includes unauthorized access to sensitive internal systems, credential harvesting, lateral movement across the network, and potential data exfiltration. Observed campaigns linked to FIN7 demonstrate the strategic use of such methods to maintain persistence and minimize the visibility of their malicious toolset within target environments.

Recommendation

Prioritize the implementation of network-based monitoring for unusual file downloads and restrict ingress of suspicious file types to authorized hosts.

• Deploy the provided detection logic to correlate HTTP/TLS traffic with specific file extensions (.rar, .ps1).
• Configure network-based detection to alert on connections to external IP addresses that lack a legitimate business justification.
• Establish a process to white-list IP addresses of known internal software update servers and security tool distribution endpoints to reduce false positives.
• Conduct regular hunts for outbound requests from workstations to uncommon external IP ranges, specifically looking for attempts to fetch scripts or compressed archives.
• Enhance visibility by ensuring network traffic logs from firewalls (Palo Alto, Fortinet) are effectively ingested into the SIEM and mapped against established internal network segments.