Cross-source coverage

T1560.002 / ATT&CK

Archive Collected Data: Archive via Library

4 rules across 2 sources.

From MITRE ATT&CK 19.2

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile, libzip, and zlib. Most libraries include functionality to encrypt and/or compress data.

Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:MMAPauditd:FILEmacos:unifiedlog

How MITRE says to detect it DET0268

Detect Archiving via Library (T1560.002)

Windows Analytic 0747

Detects adversarial archiving using libraries (zlib, zip APIs) invoked by scripts or binaries. Correlates process executions of Python, PowerShell, or custom.NET binaries with DLL/module loads linked to compression libraries, followed by archive file creation.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 0748

Detects adversarial archiving by scripts or binaries calling compression libraries (libzip, zlib, bzip2). Correlates execution of Python, Perl, or compiled binaries with dynamic linking to archiving libraries and creation of compressed files in /tmp or user directories.

  • auditd:SYSCALL execve: Execution of python, perl, or custom binaries invoking compression libraries
  • auditd:MMAP load: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving
  • auditd:FILE create: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories

macOS Analytic 0749

Detects malicious archiving via system or third-party libraries (libz, libarchive) invoked by Python, Swift, or Objective-C binaries. Correlates unified logs of library loads with creation of compressed or encrypted archives (.zip,.gz,.bz2,.dmg).

  • macos:unifiedlog Execution of Python, Swift, or other binaries invoking archiving libraries
  • macos:unifiedlog Loading of libz.dylib, libarchive.dylib by non-standard applications
  • macos:unifiedlog Creation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Python-based file compression detected (gzip, bz2, zipfile, tarfile) — possible data staging High Wazuh XML
Suspicious compression via Python GZip — possible data staging High Wazuh XML
File created or manipulated with .gz extension — possible compression Medium Wazuh XML

elastic/detection-rules

1 rule
Detection Severity Format
GenAI Process Performing Encoding/Chunking Prior to Network Activity Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.