Compressed File Extraction Via Tar.EXE

Title: Compressed File Extraction Via Tar.EXE
Status: test
Description:Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.
References:
  -https://unit42.paloaltonetworks.com/chromeloader-malware/
  -https://lolbas-project.github.io/lolbas/Binaries/Tar/
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
Author: AdmU3
Date: 2023-12-19
modified:None
Tags:

• -'attack.collection'
• -'attack.exfiltration'
• -'attack.t1560'
• -'attack.t1560.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\tar.exe' OriginalFileName:'bsdtar'   selection_extract:
    CommandLine|contains: '-x'
  condition:all of selection_*
Falsepositives:
  -Likely
Level: low