Cross-source coverage
T1560.001 / ATT&CK
Archive Collected Data: Archive via Utility
39 rules across 6 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.
On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging). xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.
Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.
- Tactics
- Collection
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILEmacos:unifiedlog
How MITRE says to detect it DET0298
Detect Archiving via Utility (T1560.001)
Windows Analytic 0831
Detects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab,.zip,.7z,.rar). Identifies anomalous loading of crypt32.dll for encryption operations or execution of diantz.exe to compress remotely staged files.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=7
Linux Analytic 0832
Detects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.
auditd:SYSCALLexecve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption argumentsauditd:FILEcreate: Creation of archive files in /tmp, /var/tmp, or user home directories
macOS Analytic 0833
Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip,.dmg,.tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.
macos:unifiedlogExecution of zip, ditto, hdiutil, or openssl by processes not normally associated with archivingmacos:unifiedlogCreation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories
SigmaHQ/sigma
17 rules| Detection | Severity | Format |
|---|---|---|
| APT31 Judgement Panda Activity | Critical | Sigma |
| LiteLLM / TeamPCP Supply Chain Attack Indicators | High | Sigma |
| Rar Usage with Password and Compression Level | High | Sigma |
| Suspicious Manipulation Of Default Accounts Via Net.EXE | High | Sigma |
| 7Zip Compressing Dump Files | Medium | Sigma |
| Compress Data and Lock With Password for Exfiltration With 7-ZIP | Medium | Sigma |
| Compress Data and Lock With Password for Exfiltration With WINZIP | Medium | Sigma |
| Disk Image Mounting Via Hdiutil - MacOS | Medium | Sigma |
| Potentially Suspicious Compression Tool Parameters | Medium | Sigma |
| Winrar Compressing Dump Files | Medium | Sigma |
+ 7 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
7 rules| Detection | Severity | Format |
|---|---|---|
| Base64 encoding used on local file (T1560.001 - Archive via Utility) | High | Wazuh XML |
| GPG symmetric encryption activity (T1560.001 - Archive via Utility) | High | Wazuh XML |
| OpenSSL encryption used for data archiving (T1560.001 - Archive via Utility) | High | Wazuh XML |
| Password-protected zip file detected (T1560.001 - Archive via Utility) | High | Wazuh XML |
| Archiving with zip detected (T1560.001 - Archive via Utility) | Medium | Wazuh XML |
| File compression with gzip detected (T1560.001 - Archive via Utility) | Medium | Wazuh XML |
| Tar archiving detected (T1560.001 - Archive via Utility) | Medium | Wazuh XML |
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| 7zip CommandLine To SMB Share Path | Undefined | SPL |
| Anomalous usage of 7zip | Undefined | SPL |
| Detect Renamed 7-Zip | Undefined | SPL |
| Detect Renamed WinRAR | Undefined | SPL |
| IcedID Exfiltrated Archived File Creation | Undefined | SPL |
| Windows Archive Collected Data via Rar | Undefined | SPL |
elastic/detection-rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Sensitive Files Compression Inside A Container | High | Elastic TOML |
| Encrypting Files with WinRar or 7z | Medium | Elastic TOML |
| GenAI Process Performing Encoding/Chunking Prior to Network Activity | Medium | Elastic TOML |
| Sensitive File Compression Detected via Defend for Containers | Medium | Elastic TOML |
| Sensitive Files Compression | Medium | Elastic TOML |
Wazuh Core Ruleset
3 rules| Detection | Severity | Format |
|---|---|---|
| Powershell used .NET compression method, possible data extraction operation | High | Wazuh XML |
| launched by executed a compressed file creation command · win.eventdata.commandLine = (?i)\.(zip|7z|rar) | Medium | Wazuh XML |
| Powershell executed file compression | Low | Wazuh XML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| suspicious_compression_tool_parameters | Undefined | YARA-L |