Tar.exe

Used by Windows to extract and create archives.

ADS

Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}

Compress one or more files to an alternate data stream (ADS). — MITRE: T1564.004 — Privileges: User

Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

tar -xf {PATH}:ads

Decompress a compressed file from an alternate data stream (ADS). — MITRE: T1564.004 — Privileges: User

Copy

Copy files

tar -xf {PATH_SMB:.tar}

Extracts archive.tar from the remote (internal) host to the current host. — MITRE: T1105 — Privileges: User