Tar.exe

Commands

1. ADSUser T1564.004

   Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

   tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}

   Compress one or more files to an alternate data stream (ADS).

   os: Windows 10, Windows 11

   Type: Compression

2. ADSUser T1564.004

   Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

   tar -xf {PATH}:ads

   Decompress a compressed file from an alternate data stream (ADS).

   os: Windows 10, Windows 11

   Type: Compression

3. CopyUser T1105

   Copy files

   tar -xf {PATH_SMB:.tar}

   Extracts archive.tar from the remote (internal) host to the current host.

   os: Windows 10, Windows 11

   Type: Compression

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_compression.yml
• Sigma https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
• IOCtar.exe extracting files from a remote host within the environment
• IOCAbnormal processes spawning tar.exe
• IOCtar.exe interacting with alternate data streams (ADS)

Resources

• https://twitter.com/Cyber_Sorcery/status/1619819249886969856