Rule Info
Name
Compressed File Creation Via Tar.EXE
Author
Nasreddine Bencherchali (Nextron Systems), AdmU3
Description
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Date
2023-12-19 00:00:00
Modified
None
Id
418a3163-3247-4b7b-9933-dcfcb7c52ea9
Tags
attack.collection attack.exfiltration attack.t1560 attack.t1560.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
Merge PR #5065 from @nasbench - Promote older rules status from `experimental` to `test`
2024-11-01
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Scan your endpoints, forensic images or collected files with our portable scanner THOR