Tar.exe
Used by Windows to extract and create archives.
Paths
C:\Windows\System32\tar.exeC:\Windows\SysWOW64\tar.exe
Commands
ADS
Compress one or more files to an alternate data stream (ADS).
Use case: Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism
Privileges: User
tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}ADS
Decompress a compressed file from an alternate data stream (ADS).
Use case: Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism
Privileges: User
tar -xf {PATH}:adsCopy
Extracts archive.tar from the remote (internal) host to the current host.
Use case: Copy files
Privileges: User
tar -xf {PATH_SMB:.tar}Detection
- Sigma: https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_compression.yml
- Sigma: https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
- IOC: tar.exe extracting files from a remote host within the environment
- IOC: Abnormal processes spawning tar.exe
- IOC: tar.exe interacting with alternate data streams (ADS)