Nothing needs to be installed to compress files. The tools are already on the machine. Archive via Utility (T1560.001) is the use of those utilities to compress or encrypt collected data before exfiltration. MITRE lists it under Collection, for Linux, macOS and Windows.
How attackers use it
MITRE describes many utilities that can compress, encrypt, or package data into a format that is easier or safer to transport. Some are preinstalled, such as tar on Linux and macOS, or zip on Windows.
On Windows, MITRE names diantz and makecab, which can package files into a cabinet (.cab) file. diantz can also download and compress files from remote locations, which ties into Remote Data Staging. xcopy can copy files and directories with many options. MITRE also notes that certutil may be used to Base64 encode collected data before exfiltration. Third-party tools such as 7-Zip, WinRAR and WinZip can do the same job.
The appeal is that most of this looks like administration. A process running tar or makecab does not stand out by name alone.
How to detect it
MITRE's analytics watch process creation followed by archive file creation, on each platform.
- Windows. Creation of processes for makecab, diantz, xcopy, certutil, 7z, WinRAR or WinZip, with command lines that set compression or encoding, followed by archive files such as .cab, .zip, .7z or .rar. Loading of crypt32.dll for encryption, and diantz compressing remotely staged files, are also called out.
- Linux. Execution of tar, gzip, bzip2, xz, zip or openssl, followed by archive creation in temporary or staging directories with compression or encryption options.
- macOS. zip, ditto, hdiutil or openssl used for encryption, creating .zip, .dmg or .tar.gz files in user or temp directories, especially when launched by Office applications or daemons.
Collect command lines, not only process names. The arguments are where you see the source folder and the output path.
How to reduce the risk
MITRE lists one mitigation: audit. Run system scans to find unauthorized archival utilities. Pair that with an application allowlist on servers, so a surprise copy of 7-Zip or WinRAR on a database host is a finding and not a normal day.
What separates admin use from staging
The same tools that pack data for an attacker pack backups for an administrator. Telling them apart takes context, and context is the thing to log. Four questions do most of the work.
- Who started it? A backup service account running tar at 2 a.m. is normal. A user's shell launching 7-Zip on a server is not.
- What was the source? Archiving an application directory is routine. Archiving document shares, home folders or databases is a stronger signal.
- Where did the output land? A designated backup location is fine. A temp or staging directory is a flag.
- What came after? An upload, a copy to an external share or a large outbound transfer ties the pieces together.
Write your rule around two or more of these, not the tool name alone. Tool names are easy for an adversary to change, and your rule will outlive them.
Check your own environment
# Windows (PowerShell): find running processes with an archiver or cabinet tool name, read-only
Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'makecab|diantz|7z|rar|certutil' } | Select-Object Name,CommandLine
# Linux or macOS: look for large archives recently created in temp directories, read-only
find /tmp /var/tmp -type f \( -name '*.tar*' -o -name '*.zip' -o -name '*.gz' \) -mtime -7 -size +50M 2>/dev/null
Then ask whether your logs would show who ran those tools last week. If not, fix logging first.
Quick check
Why does MITRE mention certutil in an archiving technique?
certutil can Base64 encode data, which is a way to package it before exfiltration.
What is the first signal in MITRE's analytic for these tools?
Process creation for the archive utility, with command-line arguments that set compression, encryption or encoding, followed by creation of an archive file.
