If every known archiver is monitored, the next step is to skip them all. Archive via Custom Method (T1560.003) is a Collection technique for Linux, macOS and Windows. It is a subtechnique of Archive Collected Data.
How attackers use it
MITRE explains that an adversary may compress or encrypt collected data before exfiltration using a custom method. Examples include encryption with XOR, or stream ciphers implemented without any external library or utility. Custom versions of well-known compression algorithms have also been used.
Because there is no library or tool to name, rules keyed to tool names do not apply.
How to detect it
MITRE's analytics focus on what the output looks like and what produced it.
- Windows. Anomalous script or binary execution that produces high-entropy files without standard archiving utilities. Memory API use such as bitwise operations or CryptoAPI calls, and creation of archive-like files with uncommon headers.
- Linux. Scripts in Python, Perl or Bash that create high-entropy files in temporary or user directories. Processes performing unusual bitwise operations, or writing files that lack standard compression headers.
- macOS. Swift or Objective-C apps or scripts that produce high-entropy files with non-standard headers, with unified logs showing abnormal file handle and data operations.
High entropy plus an unfamiliar file header plus an unusual writer is the combination. Any one alone is noisy.
How to reduce the risk
MITRE does not list a mitigation for this subtechnique, because the behavior is software logic and not a feature to switch off. The defenses sit earlier and later in the chain: restricting what can run, and watching for the staging and exfiltration that follow.
Quick check
What file properties does MITRE point to for custom archiving?
High entropy, and headers that do not match any standard compression format.
