LOL · Binary

Tar.exe

3 techniques WindowsLOLBAS GPL-3.0

Defense EvasionFile Write Windows

Compress one or more files to an alternate data stream (ADS).

Use Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}

Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_compression.yml
Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
IOC: tar.exe extracting files from a remote host within the environment
IOC: Abnormal processes spawning tar.exe
IOC: tar.exe interacting with alternate data streams (ADS)
Refs: twitter.com/Cyber_Sorcery/status/1619819249886969856
lolbas-project.github.io/lolbas/Binaries/Tar/

Defense EvasionFile Write Windows

Decompress a compressed file from an alternate data stream (ADS).

Use Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism

tar -xf {PATH}:ads

Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_compression.yml
Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
IOC: tar.exe extracting files from a remote host within the environment
IOC: Abnormal processes spawning tar.exe
IOC: tar.exe interacting with alternate data streams (ADS)
Refs: twitter.com/Cyber_Sorcery/status/1619819249886969856
lolbas-project.github.io/lolbas/Binaries/Tar/

Copy

File Copy Windows

Extracts archive.tar from the remote (internal) host to the current host.

Use Copy files

tar -xf {PATH_SMB:.tar}

Context: user
Native: Copy
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_compression.yml
Sigma: github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_tar_extraction.yml
IOC: tar.exe extracting files from a remote host within the environment
IOC: Abnormal processes spawning tar.exe
IOC: tar.exe interacting with alternate data streams (ADS)
Refs: twitter.com/Cyber_Sorcery/status/1619819249886969856
lolbas-project.github.io/lolbas/Binaries/Tar/