Windows Rar.exe Files Added to Archive Activity
Alerts when Windows rar.exe is used to add files to an archive using the " a " command-line pattern.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, E.M. Anhaus, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of rar.exe where the command line contains the archive-file add syntax (" a "). Attackers commonly compress collected files into archives to reduce size, improve portability, and facilitate staging or exfiltration. The detection relies on Windows process creation telemetry including the executed image path/name and command-line contents.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rar_compress_data.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Rar.exe Files Added to Archive Activity
id: 4df6d82c-5055-43e9-a32a-07485c207e0e
status: test
description: This rule flags process executions of rar.exe where the command line contains the archive-file add syntax (" a "). Attackers commonly compress collected files into archives to reduce size, improve portability, and facilitate staging or exfiltration. The detection relies on Windows process creation telemetry including the executed image path/name and command-line contents.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
- https://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rar_compress_data.yml
author: Timur Zinniatullin, E.M. Anhaus, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-02-05
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \rar.exe
CommandLine|contains: " a "
condition: selection
falsepositives:
- Highly likely if rar is a default archiver in the monitored environment.
level: low
license: DRL-1.1
related:
- id: 6f3e2987-db24-4c78-a860-b4f4095a7095
type: derived