Cross-source coverage
T1560.003 / ATT&CK
Archive Collected Data: Archive via Custom Method
1 rule across 1 source.
From MITRE ATT&CK 19.2
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.
- Tactics
- Collection
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILElinux:osquerymacos:unifiedlog
How MITRE says to detect it DET0438
Detect Archiving via Custom Method (T1560.003)
Windows Analytic 1213
Detects suspicious custom compression/encryption routines through anomalous script or binary execution that produces high-entropy files without standard archiving utilities. Correlates script execution, memory API usage (bitwise ops, CryptoAPI calls), and creation of archive-like files with uncommon headers.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=10
Linux Analytic 1214
Detects custom archive routines by correlating script execution (Python, Perl, Bash) with creation of high-entropy files in temporary or user directories. Flags processes performing unusual bitwise operations or writing files without standard compression headers.
auditd:SYSCALLexecve: Execution of interpreters creating archive-like outputs without calling tar/gzipauditd:FILEcreate: Creation of files with anomalous headers and entropy levels in /tmp or user directorieslinux:osqueryDetection of bitwise operations or custom encryption functions in memory traces
macOS Analytic 1215
Detects custom archiving by monitoring execution of Swift/Objective-C apps or scripts producing high-entropy files with non-standard headers. Correlates unified logs of abnormal NSFileHandle/NSData operations, memory use of XOR/bitwise operations, and file creation events.
macos:unifiedlogSuspicious Swift/Objective-C or scripting processes writing archive-like outputsmacos:unifiedlogCreation of files with anomalous headers and entropy valuesmacos:unifiedlogAbnormal memory operations (XOR/bitwise loops) during archive generation
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential Data Collection in Temporary Directory by Hidden Executable | Undefined | Elastic TOML |