WinRAR Execution in Non-Standard Folder — Detection Rule

Detects a suspicious WinRAR execution in a folder which is not the default installation folder

Read the full analysis on IntelFusions