Compressed File Extraction Via Tar.EXE
This rule detects the execution of 'tar.exe' with the '-x' command-line argument, indicating an attempt to extract compressed files. Adversaries often use legitimate utilities like 'tar.exe' to decompress data, which can help them avoid detection and prepare collected data for further actions like exfiltration. The rule specifically looks for the 'tar.exe' image or an original filename of 'bsdtar' combined with the extraction flag.
Sigma
