Techniques › T1560 › T1560.001
T1560.001 Archive via Utility
collection — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
17
Sigma rules tagged attack.t1560.001
2
KEV CVEs mapped here
<p>Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.</p><p>Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems.</p><p>On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. Remote Data Staging). <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.</p><p>Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0298 Detect Archiving via Utility (T1560.001) v1.0
AN0831 WindowsDetects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab, .zip, .7z, .rar). Identifies anomalous loading of crypt32.dll for encryption operations or execution of diantz.exe to compress remotely staged files.Tunable:
SuspiciousExtensionsProcessAllowlistFileSizeThresholdMBAN0832 LinuxDetects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.auditd:SYSCALLexecve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments→ DC0064 Command Executionauditd:FILEcreate: Creation of archive files in /tmp, /var/tmp, or user home directories→ DC0039 File CreationTunable:ArchiveCommandsMonitoredDirectoriesTimeWindowAN0833 macOSDetects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip, .dmg, .tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.macos:unifiedlogExecution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving→ DC0032 Process Creationmacos:unifiedlogCreation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories→ DC0039 File CreationTunable:AllowedArchiversUserContextPayloadEntropyThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1560.001
Author: Florian Roth (Nextron Systems)
· 2019-02-21 (modified 2023-03-10) · logsource: product=windows category=process_creation · 03e2746e-2b31-42f1-ab7a-eb39365b2422
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report
Author: Florian Roth (Nextron Systems)
· 2022-01-04 (modified 2023-09-12) · logsource: product=windows category=process_creation · 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Author: Florian Roth (Nextron Systems), Samir Bousseaden
· 2019-10-15 (modified 2023-08-29) · logsource: product=windows category=process_creation · 27a72a60-7e5e-47b1-9d17-909c9abafdcd
Detects potentially suspicious command line arguments of common data compression tools
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-30 · logsource: product=linux category=process_creation · 36603778-030c-43c4-8cbb-cd3c1d1a80c7
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8).
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Author: Nasreddine Bencherchali (Nextron Systems), AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · 418a3163-3247-4b7b-9933-dcfcb7c52ea9
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Author: Florian Roth (Nextron Systems), Tigzy
· 2021-11-17 (modified 2025-07-16) · logsource: product=windows category=process_creation · 4ede543c-e098-43d9-a28f-dd784a13132f
Detects a suspicious WinRAR execution in a folder which is not the default installation folder
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-01 (modified 2023-02-21) · logsource: product=windows category=process_creation · 5b768e71-86f2-4879-b448-81061cbae951
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
Various protocols maybe used to put data on the device for exfil or infil
Author: Timur Zinniatullin, E.M. Anhaus, oscd.community
· 2019-10-21 (modified 2023-02-05) · logsource: product=windows category=process_creation · 6f3e2987-db24-4c78-a860-b4f4095a7095
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Author: frack113
· 2021-07-27 (modified 2026-06-05) · logsource: product=windows category=process_creation · 9fbf5927-5261-4284-a71d-f681029ea574
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2023-07-28) · logsource: product=linux service=auditd · a3b5e3e9-1b49-4119-8b8e-0344a01f21ee
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-10 (modified 2026-06-05) · logsource: product=windows category=process_creation · b717b8fd-6467-4d7d-b3d3-27f9a463af77
Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.
Author: Omar Khaled (@beacon_exe)
· 2024-08-10 · logsource: product=macos category=process_creation · bf241472-f014-4f01-a869-96f99330ca8c
Detects the execution of the hdiutil utility in order to mount disk images.
Author: AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · bf361876-6620-407a-812f-bfe11e51e924
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Author: frack113
· 2021-07-27 (modified 2022-12-25) · logsource: product=windows category=process_creation · e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-27 (modified 2026-06-05) · logsource: product=windows category=process_creation · ec570e53-4c76-45a9-804d-dc3f355ff7a7
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Author: @ROxPinTeddy
· 2020-05-12 (modified 2022-03-16) · logsource: product=windows category=process_creation · faa48cae-6b25-4f00-a094-08947fef582f
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Rules tagged at the parent level (attack.t1560) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems), AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · 418a3163-3247-4b7b-9933-dcfcb7c52ea9
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2023-12-15) · logsource: product=windows category=ps_script · 6dc5d284-69ea-42cf-9311-fb1c3932a69a
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
· 2021-08-09 (modified 2022-10-09) · logsource: product=windows category=process_creation · aa92fd02-09f2-48b0-8a93-864813fb8f41
Detects a command used by conti to exfiltrate NTDS
Author: AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · bf361876-6620-407a-812f-bfe11e51e924
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.