Compressed File Creation Via Tar.EXE

Title: Compressed File Creation Via Tar.EXE
Status: test
Description:Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
References:
  -https://unit42.paloaltonetworks.com/chromeloader-malware/
  -https://lolbas-project.github.io/lolbas/Binaries/Tar/
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
Author: Nasreddine Bencherchali (Nextron Systems), AdmU3
Date: 2023-12-19
modified:None
Tags:

• -'attack.collection'
• -'attack.exfiltration'
• -'attack.t1560'
• -'attack.t1560.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\tar.exe' OriginalFileName:'bsdtar'   selection_create:
    CommandLine|contains:
      -'-c'
      -'-r'
      -'-u'

  condition:all of selection_*
Falsepositives:
  -Likely
Level: low