Compressed File Creation Via Tar.EXE

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•1•0•18

This rule detects the execution of 'tar.exe' with command-line arguments indicative of creating a compressed archive. Specifically, it looks for the '-c' (create), '-r' (append or update), or '-u' (update) flags. This activity is often associated with adversaries compressing data before exfiltration.