WinRAR Data Staging via Command-Line Archive Flags (T1560.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of WinRAR or rar.exe with command-line arguments often used for staging data, including file addition, archive creation, and extraction. This activity is frequently associated with the preparation of files for exfiltration or the unpacking of malicious payloads.