Compressed File Extraction Via Tar.EXE

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•0•0

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.