Tar Archive Creation in User-Writable Directories

Jorden Smith@Jorden

•updated Feb 10, 2026•1•0•11

The rule detects the creation of tar archive files (including .tar, .tar.gz, .tgz, and .tar.bz2) within common user-writable directories on Windows systems. Specifically, it looks for these archive files being created in paths containing '\Downloads\', '\Temp\', '\Public\', '\Desktop\', '\AppData\Local\Temp\', or 'C:\ProgramData\'. This activity could indicate data staging for exfiltration, where an attacker collects and archives data before moving it out of the compromised system.