Cross-source coverage

T1560.003 / ATT&CK

Archive Collected Data: Archive via Custom Method

1 rule across 1 source.

From MITRE ATT&CK 19.2

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILElinux:osquerymacos:unifiedlog

How MITRE says to detect it DET0438

Detect Archiving via Custom Method (T1560.003)

Windows Analytic 1213

Detects suspicious custom compression/encryption routines through anomalous script or binary execution that produces high-entropy files without standard archiving utilities. Correlates script execution, memory API usage (bitwise ops, CryptoAPI calls), and creation of archive-like files with uncommon headers.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=10

Linux Analytic 1214

Detects custom archive routines by correlating script execution (Python, Perl, Bash) with creation of high-entropy files in temporary or user directories. Flags processes performing unusual bitwise operations or writing files without standard compression headers.

  • auditd:SYSCALL execve: Execution of interpreters creating archive-like outputs without calling tar/gzip
  • auditd:FILE create: Creation of files with anomalous headers and entropy levels in /tmp or user directories
  • linux:osquery Detection of bitwise operations or custom encryption functions in memory traces

macOS Analytic 1215

Detects custom archiving by monitoring execution of Swift/Objective-C apps or scripts producing high-entropy files with non-standard headers. Correlates unified logs of abnormal NSFileHandle/NSData operations, memory use of XOR/bitwise operations, and file creation events.

  • macos:unifiedlog Suspicious Swift/Objective-C or scripting processes writing archive-like outputs
  • macos:unifiedlog Creation of files with anomalous headers and entropy values
  • macos:unifiedlog Abnormal memory operations (XOR/bitwise loops) during archive generation

elastic/protections-artifacts

1 rule
Detection Severity Format
Potential Data Collection in Temporary Directory by Hidden Executable Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.