Suspicious Greedy Compression Using Rar.EXE
Detects the use of rar.exe to create an archive with a password and recursive flag, specifically targeting system folders or common staging directories. This behavior is often associated with attackers collecting and preparing data for exfiltration.
Sigma
