LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Tar.exe

View source

Used by Windows to extract and create archives.

ADSCopy
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

ADS2

EXAMPLE 01T1564.004

Compress one or more files to an alternate data stream (ADS).

COMMAND
tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}
USE CASE
Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Type · Compression
EXAMPLE 02T1564.004

Decompress a compressed file from an alternate data stream (ADS).

COMMAND
tar -xf {PATH}:ads
USE CASE
Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Type · Compression

Copy1

EXAMPLE 01T1105

Extracts archive.tar from the remote (internal) host to the current host.

COMMAND
tar -xf {PATH_SMB:.tar}
USE CASE
Copy files
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Type · Compression
02 / ON DISK

Known paths

C:\Windows\System32\tar.exe
C:\Windows\SysWOW64\tar.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    tar.exe extracting files from a remote host within the environment

  • IOC

    Abnormal processes spawning tar.exe

  • IOC

    tar.exe interacting with alternate data streams (ADS)

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Brian Lucero@Cyber_Sorcery
Avester Fahimipour