huntrule

Windows: tar.exe Archive Extraction Using -x Flag

Flags Windows process executions of tar.exe with -x to extract compressed archives.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
AdmU3 (SigmaHQ), DRL 1.1
Published
2023-12-19
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of tar.exe on Windows that performs archive extraction by matching a command line containing the -x option. Attackers often use legitimate compression utilities to decompress files as part of staging or execution while blending in with normal tool usage. Telemetry required includes Windows process creation events with process image/metadata and command line arguments.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange
Windows tar.exe Used to Create Compressed Archives
Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)
Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)
Suspicious Archive Staged in Web Accessible Directory via tar
Suspicious Archive Staged in Web Root via tar on Ivanti EPMM
Suspicious Payload Staging in Public Libraries Directory via file_event
Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)
Suspicious WinRAR Silent Archive Staging
Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)
Windows: tar.exe Archive Extraction Using -x Flag
Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.