Rar Usage with Password and Compression Level

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.