Techniques › T1560 › T1560.002
T1560.002 Archive via Library
collection — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1560.002
0
KEV CVEs mapped here
<p>An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile, libzip, and zlib. Most libraries include functionality to encrypt and/or compress data.</p><p>Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0268 Detect Archiving via Library (T1560.002) v1.0
AN0747 WindowsDetects adversarial archiving using libraries (zlib, zip APIs) invoked by scripts or binaries. Correlates process executions of Python, PowerShell, or custom .NET binaries with DLL/module loads linked to compression libraries, followed by archive file creation.Tunable:
LibraryAllowlistSuspiciousExtensionsTimeWindowAN0748 LinuxDetects adversarial archiving by scripts or binaries calling compression libraries (libzip, zlib, bzip2). Correlates execution of Python, Perl, or compiled binaries with dynamic linking to archiving libraries and creation of compressed files in /tmp or user directories.auditd:SYSCALLexecve: Execution of python, perl, or custom binaries invoking compression libraries→ DC0064 Command Executionauditd:MMAPload: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving→ DC0016 Module Loadauditd:FILEcreate: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories→ DC0039 File CreationTunable:MonitoredLibrariesArchivePathsEntropyThresholdAN0749 macOSDetects malicious archiving via system or third-party libraries (libz, libarchive) invoked by Python, Swift, or Objective-C binaries. Correlates unified logs of library loads with creation of compressed or encrypted archives (.zip, .gz, .bz2, .dmg).macos:unifiedlogExecution of Python, Swift, or other binaries invoking archiving libraries→ DC0032 Process Creationmacos:unifiedlogLoading of libz.dylib, libarchive.dylib by non-standard applications→ DC0016 Module Loadmacos:unifiedlogCreation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories→ DC0039 File CreationTunable:AllowedProcessesUserContextFileExtensionFilter
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1560.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1560) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems), AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · 418a3163-3247-4b7b-9933-dcfcb7c52ea9
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2023-12-15) · logsource: product=windows category=ps_script · 6dc5d284-69ea-42cf-9311-fb1c3932a69a
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
· 2021-08-09 (modified 2022-10-09) · logsource: product=windows category=process_creation · aa92fd02-09f2-48b0-8a93-864813fb8f41
Detects a command used by conti to exfiltrate NTDS
Author: AdmU3
· 2023-12-19 · logsource: product=windows category=process_creation · bf361876-6620-407a-812f-bfe11e51e924
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.