Potemkin Loader - Tar.exe Archive Extraction (T1105)
This rule detects the use of the native Windows 'tar.exe' utility to extract a ZIP archive into an AppData staging path. This behavior is associated with the Potemkin Loader, which downloads a ZIP payload and then silently extracts it. The rule specifically looks for 'tar.exe' being executed with the command-line arguments '-xf' followed by a ZIP file and '-C' followed by a path containing 'AppData'.
Microsoft Sentinel (KQL)
