tar.exe LOLBin Archive Extraction to Suspicious Staging Locations

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.