WinRAR Command-Line Archive Creation for Data Staging Prior to Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of WinRAR (rar.exe or WinRAR.exe) to archive files, specifically flagging operations that involve recursion, password protection (-hp), or targeting network shares. This behavior is commonly used by adversaries for data staging prior to exfiltration.