Windows: Detect rar.exe Archive Creation Using Password or Compression Options
Alerts on rar.exe command lines that include both password protection (-hp) and additional compression/archive flags.
- Product
- windows
- Category
- process_creation
- Author
- @ROxPinTeddy (SigmaHQ), DRL 1.1
- Published
- 2020-05-12
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where rar.exe is invoked with command-line arguments that include a password flag and other archive configuration flags. Attackers commonly compress and protect files to package sensitive data or evade inspection, making rar command-line usage with these specific options noteworthy. It relies on Windows process creation telemetry and matches on substrings present in the process command line.
Reporting behind it
- labs.sentinelone.comhttps://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/
- ss64.comhttps://ss64.com/bash/rar.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect rar.exe Archive Creation Using Password or Compression Options"
id: 1253ce38-bf0c-4232-a840-447f550dc07b
status: test
description: This rule flags process creation where rar.exe is invoked with command-line arguments that include a password flag and other archive configuration flags. Attackers commonly compress and protect files to package sensitive data or evade inspection, making rar command-line usage with these specific options noteworthy. It relies on Windows process creation telemetry and matches on substrings present in the process command line.
references:
- https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/
- https://ss64.com/bash/rar.html
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml
author: "@ROxPinTeddy, Huntrule Team"
date: 2020-05-12
modified: 2022-03-16
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_password:
CommandLine|contains: " -hp"
selection_other:
CommandLine|contains:
- " -m"
- " a "
condition: selection_password and selection_other
falsepositives:
- Legitimate use of Winrar command line version
- Other command line tools, that use these flags
level: high
license: DRL-1.1
related:
- id: faa48cae-6b25-4f00-a094-08947fef582f
type: derived