Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Suspicious Greedy Compression Using Rar.EXE

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

ATT&CK coverage

Outside the enterprise matrix

T1059

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Unknown

References

https://decoded.avast.io/martinchlumecky/png-steganography

Tagged by the source as

attack.execution

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.