Techniques › T1560 › T1560.003

T1560.003 Archive via Custom Method

collection — Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0438 Detect Archiving via Custom Method (T1560.003) v1.0
  AN1213 Windows

  Detects suspicious custom compression/encryption routines through anomalous script or binary execution that produces high-entropy files without standard archiving utilities. Correlates script execution, memory API usage (bitwise ops, CryptoAPI calls), and creation of archive-like files with uncommon headers.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  Tunable: EntropyThreshold AllowedProcesses TimeWindow
  AN1214 Linux

  Detects custom archive routines by correlating script execution (Python, Perl, Bash) with creation of high-entropy files in temporary or user directories. Flags processes performing unusual bitwise operations or writing files without standard compression headers.

  auditd:SYSCALL execve: Execution of interpreters creating archive-like outputs without calling tar/gzip → DC0064 Command Execution

  auditd:FILE create: Creation of files with anomalous headers and entropy levels in /tmp or user directories → DC0039 File Creation

  linux:osquery Detection of bitwise operations or custom encryption functions in memory traces → DC0020 Process Modification

  Tunable: ArchivePaths EntropyThreshold ScriptAllowlist
  AN1215 macOS

  Detects custom archiving by monitoring execution of Swift/Objective-C apps or scripts producing high-entropy files with non-standard headers. Correlates unified logs of abnormal NSFileHandle/NSData operations, memory use of XOR/bitwise operations, and file creation events.

  macos:unifiedlog Suspicious Swift/Objective-C or scripting processes writing archive-like outputs → DC0032 Process Creation

  macos:unifiedlog Creation of files with anomalous headers and entropy values → DC0039 File Creation

  macos:unifiedlog Abnormal memory operations (XOR/bitwise loops) during archive generation → DC0020 Process Modification

  Tunable: UserContext EntropyThreshold AllowedApps

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1560.003

Rules tagged at the parent level (attack.t1560) 4

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.