Potemkin Loader - Tar.exe Archive Extraction
Detects the use of the native Windows tar.exe utility to silently extract ZIP archives into the AppData directory. This behavior is associated with the Potemkin Loader, which often uses this technique to stage malicious payloads after downloading them.
Microsoft Sentinel (KQL)
