huntrule

Windows Rar.exe Files Added to Archive Activity

Alerts when Windows rar.exe is used to add files to an archive using the " a " command-line pattern.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
Timur Zinniatullin, E.M. Anhaus, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-21
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of rar.exe where the command line contains the archive-file add syntax (" a "). Attackers commonly compress collected files into archives to reduce size, improve portability, and facilitate staging or exfiltration. The detection relies on Windows process creation telemetry including the executed image path/name and command-line contents.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange
Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)
Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)
Suspicious Archive Staged in Web Accessible Directory via tar
Suspicious Archive Staged in Web Root via tar on Ivanti EPMM
Suspicious Payload Staging in Public Libraries Directory via file_event
Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)
Suspicious WinRAR Silent Archive Staging
Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)
Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
Windows Rar.exe Files Added to Archive Activity
Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.