Files Added To An Archive Using Rar.EXE
This rule detects the use of 'rar.exe' to add files to an archive. Adversaries often compress collected data, such as sensitive documents, before exfiltration to make it more portable and reduce the amount of data transferred over the network. The detection specifically looks for the execution of 'rar.exe' with the 'a' command-line argument, which is used for adding files to an archive.
Sigma
