Windows tar.exe Used to Create Compressed Archives
Flags tar.exe (or bsdtar) command lines using -c/-r/-u to create or update compressed archives on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), AdmU3 (SigmaHQ), DRL 1.1
- Published
- 2023-12-19
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where Windows tar.exe (or bsdtar with OriginalFileName) is invoked to create or update an archive. Adversaries can use standard compression utilities to package data prior to staging or exfiltration, reducing size and potentially blending in with legitimate archiving activity. It relies on Windows process creation telemetry, specifically the executable path/name and the presence of tar options (-c, -r, -u) in the command line.
Reporting behind it
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/chromeloader-malware/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Tar/
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tar_compression.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows tar.exe Used to Create Compressed Archives
id: 1505ba09-337a-4db6-bb9a-e239c86a478e
status: test
description: This rule identifies process executions where Windows tar.exe (or bsdtar with OriginalFileName) is invoked to create or update an archive. Adversaries can use standard compression utilities to package data prior to staging or exfiltration, reducing size and potentially blending in with legitimate archiving activity. It relies on Windows process creation telemetry, specifically the executable path/name and the presence of tar options (-c, -r, -u) in the command line.
references:
- https://unit42.paloaltonetworks.com/chromeloader-malware/
- https://lolbas-project.github.io/lolbas/Binaries/Tar/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tar_compression.yml
author: Nasreddine Bencherchali (Nextron Systems), AdmU3, Huntrule Team
date: 2023-12-19
tags:
- attack.collection
- attack.exfiltration
- attack.t1560
- attack.t1560.001
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \tar.exe
- OriginalFileName: bsdtar
selection_create:
CommandLine|contains:
- -c
- -r
- -u
condition: all of selection_*
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9
type: derived