Sigma rule: Compressed File Extraction Via Tar.EXE
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-8bc19fa17a8a, updated 2023-12-19T00:00:00.000Z.
Rule
- Title
- Compressed File Extraction Via Tar.EXE
- Status
- test
- Level
- low
- Author
- AdmU3
- Date
- 2023-12-19
- File
- rules/windows/process_creation/proc_creation_win_tar_extraction.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Log source
- product
- windows
- category
- process_creation
Detection
selection_img:
- Image|endswith: '\tar.exe'
- OriginalFileName: 'bsdtar'
selection_extract:
CommandLine|contains: '-x'
condition: all of selection_*False positives (as the rule lists them)
- Likely
Tags
- attack.collection
- attack.exfiltration
- attack.t1560
- attack.t1560.001
MITRE ATT&CK ids this rule names
References
- https://unit42.paloaltonetworks.com/chromeloader-malware/
- https://lolbas-project.github.io/lolbas/Binaries/Tar/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
Sources and licences
SigmaHQ
"Compressed File Extraction Via Tar.EXE" by AdmU3 (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_tar_extraction.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Compressed File Extraction Via Tar.EXE",
entity page, dataset version ref-8bc19fa17a8a, updated 2023-12-19T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/bf361876-6620-407a-812f-bfe11e51e924 (accessed 2026-11-03).
Underlying source: SigmaHQ rule bf361876-6620-407a-812f-bfe11e51e924, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.