Tar.exe Output Redirected to Stdout

Paul P@ppritch

•updated Jan 28, 2026•2•0•30

Detects the execution of the native Windows tar.exe utility with flags that redirect the output to standard output (stdout) instead of a file. This behavior can indicate data being staged for exfiltration or piped to another tool for in-memory execution, bypassing file-based detections.