Windows tar.exe Used to Create Compressed Archives

title: Windows tar.exe Used to Create Compressed Archives
id: 1505ba09-337a-4db6-bb9a-e239c86a478e
status: test
description: This rule identifies process executions where Windows tar.exe (or bsdtar with OriginalFileName) is invoked to create or update an archive. Adversaries can use standard compression utilities to package data prior to staging or exfiltration, reducing size and potentially blending in with legitimate archiving activity. It relies on Windows process creation telemetry, specifically the executable path/name and the presence of tar options (-c, -r, -u) in the command line.
references:
  - https://unit42.paloaltonetworks.com/chromeloader-malware/
  - https://lolbas-project.github.io/lolbas/Binaries/Tar/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tar_compression.yml
author: Nasreddine Bencherchali (Nextron Systems), AdmU3, Huntrule Team
date: 2023-12-19
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1560
  - attack.t1560.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \tar.exe
    - OriginalFileName: bsdtar
  selection_create:
    CommandLine|contains:
      - -c
      - -r
      - -u
  condition: all of selection_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9
    type: derived