Identifier / Programs / Windows
tar.exe
Archiving utility. Often combined with a compression method, such as gzip or bzip2. tldr-pages
LOLBAS ADS, Copy 2 Sigma rules name it 4 ATT&CK techniques 3 documented commands 8 known copies with hashes
How tar.exe is abused
ADS T1564.004 Hide Artifacts: NTFS File Attributes
-cfADS T1564.004 Hide Artifacts: NTFS File Attributes
-xfCopy T1105 Ingress Tool Transfer
-xfEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for tar.exe.
3 documented commands
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Compress one or more files to an alternate data stream (ADS).
tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}Trips 1 Sigma rule: lowCompressed File Creation Via Tar.EXE by Nasreddine Bencherchali (Nextron Systems), AdmU3
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Decompress a compressed file from an alternate data stream (ADS).
tar -xf {PATH}:adsTrips 1 Sigma rule: lowCompressed File Extraction Via Tar.EXE by AdmU3
Copy T1105 Ingress Tool Transfer User privileges
Extracts archive.tar from the remote (internal) host to the current host.
tar -xf {PATH_SMB:.tar}Trips 1 Sigma rule: lowCompressed File Extraction Via Tar.EXE by AdmU3
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for tar.exe, by Brian Lucero, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for tar.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real tar.exe?
bsdtar in the file’s header: a renamed copy still carries itC:\Windows\system32\C:\Windows\SysWOW64\8 known copies
3.4.3 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tar.exe · signed by Microsoft Windows
894ec954e51362d38dae5f359363b3c54540b2a57ef508b8f0317572e6c523963.4.3 (WinBuild.160101.0800) · C:\WINDOWS\system32\tar.exe · signed by Microsoft Windows
d2d23f98bba3cc7085da3c70763838f4c2db2128c04edf3172c705740419af8c3.3.2 (WinBuild.160101.0800) · C:\Windows\system32\tar.exe · signed by Microsoft Windows
0f28c8d166c7a671b0048137232e9ca6973f1ec826104834ae310681c1866e623.3.2 (WinBuild.160101.0800) · C:\Windows\system32\tar.exe · signed by Microsoft Windows
1407b5bed4602a67c684363ae1582967193df1ce7ce387b684af031d9c94eefa3.3.2 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tar.exe · signed by Microsoft Windows
2319a2f1313a4bf4cf5e009b7cd8a6e97b4c5b63b679f5bd4fefa29cd7b3f3193.3.2 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tar.exe · signed by Microsoft Windows
45349f867f30381cfb0cc2160942970496af9a6849f8a4338179764f16740f6b3.3.2 (WinBuild.160101.0800) · C:\WINDOWS\system32\tar.exe · signed by Microsoft Windows
4fcecf6b108a20c01f0e420bf695278e937748b4912291ce6968f2424f34a7c73.3.2 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tar.exe · signed by Microsoft Windows
9d3ab89e9aa2c2c3686f43c7c8fa312b9f80180ce86137151726d16966816c50From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
create an archive and write it to a file
tar cf path/to/target.tar path/to/file1 path/to/file2 ...Identifycreate a gzipped archive and write it to a file
tar czf path/to/target.tar.gz path/to/file1 path/to/file2 ...Identifycreate a gzipped (compressed) archive from a directory using relative paths
tar czf path/to/target.tar.gz --directory path/to/directory .IdentifyNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.