Cross-source coverage

T1560 / ATT&CK

Archive Collected Data

59 rules · 56 families across 6 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Tactics: Collection
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILEmacos:unifiedlog

How MITRE says to detect it DET0526

Detect Archiving and Encryption of Collected Data (T1560)

Windows Analytic 1458

Detects adversarial archiving of files prior to exfiltration by correlating execution of compression/encryption utilities (e.g., makecab.exe, rar.exe, 7z.exe, powershell Compress-Archive) with subsequent creation of large compressed or encrypted files. Identifies abnormal process lineage involving crypt32.dll usage, command-line arguments invoking compression switches, and file write operations to temporary or staging directories.

WinEventLog:Security EventCode=4688
WinEventLog:Sysmon EventCode=11
WinEventLog:Sysmon EventCode=7

Linux Analytic 1459

Detects adversarial archiving activity through invocation of utilities like tar, gzip, bzip2, or openssl used in non-administrative or unusual contexts. Correlates command execution patterns with file creation of compressed/encrypted outputs in staging directories (e.g., /tmp, /var/tmp).

auditd:SYSCALL execve: Execution of tar, gzip, bzip2, or openssl with output redirection
auditd:FILE create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp

macOS Analytic 1460

Detects use of macOS-native archiving or encryption tools (zip, ditto, hdiutil) for staging collected data. Identifies unexpected invocation of archive utilities by Office apps, browsers, or background daemons. Correlates file creation of.zip/.dmg containers with process lineage anomalies.

macos:unifiedlog Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes
macos:unifiedlog Creation of .zip or .dmg files in user-accessible or temporary directories

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 59 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

19 rules

Detection	Severity	Format
APT31 Judgement Panda Activity	Critical	Sigma
Conti NTDS Exfiltration Command	High	Sigma
LiteLLM / TeamPCP Supply Chain Attack Indicators	High	Sigma
Rar Usage with Password and Compression Level	High	Sigma
Suspicious Manipulation Of Default Accounts Via Net.EXE	High	Sigma
7Zip Compressing Dump Files	Medium	Sigma
Compress Data and Lock With Password for Exfiltration With 7-ZIP	Medium	Sigma
Compress Data and Lock With Password for Exfiltration With WINZIP	Medium	Sigma
Disk Image Mounting Via Hdiutil - MacOS	Medium	Sigma
Potentially Suspicious Compression Tool Parameters	Medium	Sigma

+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity

socfortress/Wazuh-Rules

19 rules · 16 families

Detection	Severity	Format
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. 4 variants	High	Wazuh XML
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. 4 variants	High	Wazuh XML
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. 4 variants	High	Wazuh XML
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. 4 variants	High	Wazuh XML
Base64 encoding used on local file (T1560.001 - Archive via Utility)	High	Wazuh XML
GPG symmetric encryption activity (T1560.001 - Archive via Utility)	High	Wazuh XML
OpenSSL encryption used for data archiving (T1560.001 - Archive via Utility)	High	Wazuh XML
Password-protected zip file detected (T1560.001 - Archive via Utility)	High	Wazuh XML
Python-based file compression detected (gzip, bz2, zipfile, tarfile) — possible data staging	High	Wazuh XML
Suspicious compression via Python GZip — possible data staging	High	Wazuh XML

+ 9 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

9 rules

Detection	Severity	Format
7zip CommandLine To SMB Share Path	Undefined	SPL
Anomalous usage of 7zip	Undefined	SPL
Detect Certipy File Modifications	Undefined	SPL
Detect Renamed 7-Zip	Undefined	SPL
Detect Renamed WinRAR	Undefined	SPL
IcedID Exfiltrated Archived File Creation	Undefined	SPL
Windows Archive Collected Data via Powershell	Undefined	SPL
Windows Archive Collected Data via Rar	Undefined	SPL
Windows Archived Collected Data In TEMP Folder	Undefined	SPL

elastic/detection-rules

6 rules

Detection	Severity	Format
Sensitive File Access followed by Compression	High	Elastic TOML
Sensitive Files Compression Inside A Container	High	Elastic TOML
Encrypting Files with WinRar or 7z	Medium	Elastic TOML
GenAI Process Performing Encoding/Chunking Prior to Network Activity	Medium	Elastic TOML
Sensitive File Compression Detected via Defend for Containers	Medium	Elastic TOML
Sensitive Files Compression	Medium	Elastic TOML

Wazuh Core Ruleset

5 rules

Detection	Severity	Format
Powershell used .NET compression method, possible data extraction operation	High	Wazuh XML
launched by executed a compressed file creation command · win.eventdata.commandLine = (?i)\.(zip\|7z\|rar)	Medium	Wazuh XML
Powershell executed "Copy-Item"	Low	Wazuh XML
Powershell executed file compression	Low	Wazuh XML
Powershell executed "Set-WmiInstance". Possible creation or update of a WMI instance	Low	Wazuh XML

elastic/protections-artifacts

1 rule

Detection	Severity	Format
Potential Data Collection in Temporary Directory by Hidden Executable	Undefined	Elastic TOML