Suspicious Parent Process for Tar.exe

Paul P@ppritch

•updated Jan 28, 2026•9•0•117

Detects tar.exe being spawned by processes commonly associated with initial access or lateral movement, such as web servers or remote management services. This activity is highly indicative of post-exploitation activity like data staging.