CL-STA-1062 WinRAR Web Server Source Code Archiving for Exfiltration
Detects the execution of rar.exe with command line arguments indicating the creation of a new archive (-a) and the use of the -k switch. The -k switch in RAR is often used to lock an archive, preventing further modifications, which is a technique sometimes used by adversaries to preserve staged data for exfiltration.
CQL
