T1560.001sub-technique of T1560 Archive Collected Data
Archive via Utility
Linux · macOS · Windows2 pieces on this siteT1560.001 on attack.mitre.org
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as `tar` on Linux and macOS or `zip` on Windows systems.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Data theft extortion response plan: verify the claim, find the way out, own the notification
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
how MITRE says to see it
Detect Archiving via Utility (T1560.001)
- Detects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab,.zip,.7z,.rar).
- Detects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.
- Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip,.dmg,.tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.
what reduces it
- M1047 Audit. System scans can be performed to identify unauthorized archival utilities.