Skip to content

Hide Navigation Hide TOC

Tar (65e149a8-7c78-40d0-9cc5-9f420011facc)

This object contains information sourced from the Living Off The Land Binaries, Scripts and Libraries (LOLBAS) project, which is licensed under GNU General Public License v3.0.

Description: Used by Windows to extract and create archives.

Author: Brian Lucero

Paths: * C:\Windows\System32\tar.exe

Resources: * https://twitter.com/Cyber_Sorcery/status/1619819249886969856

Detection: * IOC: tar.exe extracting files from a remote host within the environment[Tar.exe - LOLBAS Project]

Cluster A Galaxy A Cluster B Galaxy B Level
UNC5221 (71e9b27e-8d68-4ed6-b3ab-14142558b9ff) Tidal Groups Tar (65e149a8-7c78-40d0-9cc5-9f420011facc) Tidal Software 1
UNC5325 (be7243cb-6031-4e2a-97d9-3522c002becd) Tidal Groups Tar (65e149a8-7c78-40d0-9cc5-9f420011facc) Tidal Software 1