T1560 Archive Collected Data

collection — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1560

KEV CVEs mapped here

<p>An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.</p><p>Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0526 Detect Archiving and Encryption of Collected Data (T1560) v1.0
AN1458 Windows
Detects adversarial archiving of files prior to exfiltration by correlating execution of compression/encryption utilities (e.g., makecab.exe, rar.exe, 7z.exe, powershell Compress-Archive) with subsequent creation of large compressed or encrypted files. Identifies abnormal process lineage involving crypt32.dll usage, command-line arguments invoking compression switches, and file write operations to temporary or staging directories.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

Tunable: ArchiveExtensions ProcessAllowlist FileSizeThresholdMB

AN1459 Linux
Detects adversarial archiving activity through invocation of utilities like tar, gzip, bzip2, or openssl used in non-administrative or unusual contexts. Correlates command execution patterns with file creation of compressed/encrypted outputs in staging directories (e.g., /tmp, /var/tmp).

auditd:SYSCALL execve: Execution of tar, gzip, bzip2, or openssl with output redirection → DC0064 Command Execution
auditd:FILE create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp → DC0039 File Creation

Tunable: ArchiveCommands SuspiciousDirectories TimeWindow

AN1460 macOS
Detects use of macOS-native archiving or encryption tools (zip, ditto, hdiutil) for staging collected data. Identifies unexpected invocation of archive utilities by Office apps, browsers, or background daemons. Correlates file creation of .zip/.dmg containers with process lineage anomalies.

macos:unifiedlog Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes → DC0032 Process Creation
macos:unifiedlog Creation of .zip or .dmg files in user-accessible or temporary directories → DC0039 File Creation

Tunable: AllowedArchiveUtilities UserContext PayloadEntropyThreshold

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1560`

Compressed File Creation Via Tar.EXE lowtest

Author: Nasreddine Bencherchali (Nextron Systems), AdmU3 · 2023-12-19 · logsource: product=windows category=process_creation · 418a3163-3247-4b7b-9933-dcfcb7c52ea9

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Techniques: T1560 T1560.001

Compress-Archive Cmdlet Execution lowtest

Author: Timur Zinniatullin, oscd.community · 2019-10-21 (modified 2023-12-15) · logsource: product=windows category=ps_script · 6dc5d284-69ea-42cf-9311-fb1c3932a69a

Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Techniques: T1560

Conti NTDS Exfiltration Command hightest

Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · 2021-08-09 (modified 2022-10-09) · logsource: product=windows category=process_creation · aa92fd02-09f2-48b0-8a93-864813fb8f41

Detects a command used by conti to exfiltrate NTDS

Techniques: T1560

Compressed File Extraction Via Tar.EXE lowtest

Author: AdmU3 · 2023-12-19 · logsource: product=windows category=process_creation · bf361876-6620-407a-812f-bfe11e51e924

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.