Cross-source coverage
T1560 / ATT&CK
Archive Collected Data
60 rules · 57 families across 7 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
- Tactics
- Collection
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILEmacos:unifiedlog
How MITRE says to detect it DET0526
Detect Archiving and Encryption of Collected Data (T1560)
Windows Analytic 1458
Detects adversarial archiving of files prior to exfiltration by correlating execution of compression/encryption utilities (e.g., makecab.exe, rar.exe, 7z.exe, powershell Compress-Archive) with subsequent creation of large compressed or encrypted files. Identifies abnormal process lineage involving crypt32.dll usage, command-line arguments invoking compression switches, and file write operations to temporary or staging directories.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=7
Linux Analytic 1459
Detects adversarial archiving activity through invocation of utilities like tar, gzip, bzip2, or openssl used in non-administrative or unusual contexts. Correlates command execution patterns with file creation of compressed/encrypted outputs in staging directories (e.g., /tmp, /var/tmp).
auditd:SYSCALLexecve: Execution of tar, gzip, bzip2, or openssl with output redirectionauditd:FILEcreate: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp
macOS Analytic 1460
Detects use of macOS-native archiving or encryption tools (zip, ditto, hdiutil) for staging collected data. Identifies unexpected invocation of archive utilities by Office apps, browsers, or background daemons. Correlates file creation of.zip/.dmg containers with process lineage anomalies.
macos:unifiedlogExecution of zip, ditto, hdiutil, or openssl by non-terminal parent processesmacos:unifiedlogCreation of .zip or .dmg files in user-accessible or temporary directories
Sub-techniques with coverage
Counted in the 60 above — a rule tagged a sub-technique covers this technique too.
SigmaHQ/sigma
19 rules| Detection | Severity | Format |
|---|---|---|
| APT31 Judgement Panda Activity | Critical | Sigma |
| Conti NTDS Exfiltration Command | High | Sigma |
| LiteLLM / TeamPCP Supply Chain Attack Indicators | High | Sigma |
| Rar Usage with Password and Compression Level | High | Sigma |
| Suspicious Manipulation Of Default Accounts Via Net.EXE | High | Sigma |
| 7Zip Compressing Dump Files | Medium | Sigma |
| Compress Data and Lock With Password for Exfiltration With 7-ZIP | Medium | Sigma |
| Compress Data and Lock With Password for Exfiltration With WINZIP | Medium | Sigma |
| Disk Image Mounting Via Hdiutil - MacOS | Medium | Sigma |
| Potentially Suspicious Compression Tool Parameters | Medium | Sigma |
+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
19 rules · 16 families+ 9 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
9 rules| Detection | Severity | Format |
|---|---|---|
| 7zip CommandLine To SMB Share Path | Undefined | SPL |
| Anomalous usage of 7zip | Undefined | SPL |
| Detect Certipy File Modifications | Undefined | SPL |
| Detect Renamed 7-Zip | Undefined | SPL |
| Detect Renamed WinRAR | Undefined | SPL |
| IcedID Exfiltrated Archived File Creation | Undefined | SPL |
| Windows Archive Collected Data via Powershell | Undefined | SPL |
| Windows Archive Collected Data via Rar | Undefined | SPL |
| Windows Archived Collected Data In TEMP Folder | Undefined | SPL |
elastic/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Sensitive File Access followed by Compression | High | Elastic TOML |
| Sensitive Files Compression Inside A Container | High | Elastic TOML |
| Encrypting Files with WinRar or 7z | Medium | Elastic TOML |
| GenAI Process Performing Encoding/Chunking Prior to Network Activity | Medium | Elastic TOML |
| Sensitive File Compression Detected via Defend for Containers | Medium | Elastic TOML |
| Sensitive Files Compression | Medium | Elastic TOML |
Wazuh Core Ruleset
5 rules| Detection | Severity | Format |
|---|---|---|
| Powershell used .NET compression method, possible data extraction operation | High | Wazuh XML |
| launched by executed a compressed file creation command · win.eventdata.commandLine = (?i)\.(zip|7z|rar) | Medium | Wazuh XML |
| Powershell executed "Copy-Item" | Low | Wazuh XML |
| Powershell executed file compression | Low | Wazuh XML |
| Powershell executed "Set-WmiInstance". Possible creation or update of a WMI instance | Low | Wazuh XML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| suspicious_compression_tool_parameters | Undefined | YARA-L |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential Data Collection in Temporary Directory by Hidden Executable | Undefined | Elastic TOML |