Techniques › T1560.001 › AN0833
AN0833 Analytic 0833
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip, .dmg, .tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.</p>
- Detects
- T1560.001 Archive via Utility
- Part of
- DET0298 Detect Archiving via Utility (T1560.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving | DC0032 Process Creation |
| macos:unifiedlog | Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedArchivers | Business-approved applications permitted to create archives (e.g., backup agents). |
UserContext | Flag archiving under privileged or service accounts as higher risk. |
PayloadEntropyThreshold | Entropy threshold for detecting encrypted archives versus normal compression. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-40539 | Zoho ManageEngine | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Mapped |