Stolen data is bulky, and it is easier to move and harder to inspect when it is packed. Archive Collected Data (T1560) is the technique of compressing or encrypting data before it is exfiltrated. MITRE lists it under the Collection tactic, for Linux, macOS and Windows.
How attackers use it
MITRE explains two goals. Compression can obfuscate the collected data and reduce the amount sent over the network. Encryption can hide what is being exfiltrated, or make the exfiltration less conspicuous when a defender inspects it. Both happen before exfiltration, and either can be done with a utility, a third-party library, or a custom method. The three subtechniques cover exactly those: Archive via Utility, Archive via Library, and Archive via Custom Method.
How to detect it
MITRE's detection strategy is built around process execution and file creation, with a variant per platform.
- Windows. Compression or encryption tools such as makecab.exe, rar.exe, 7z.exe or PowerShell Compress-Archive, followed by creation of large compressed or encrypted files. Unusual process lineage involving crypt32.dll, compression switches on the command line, and writes to temporary or staging folders are all signals.
- Linux. Tools such as tar, gzip, bzip2 or openssl used in non-administrative or unusual contexts, with output files in staging folders such as /tmp and /var/tmp.
- macOS. Native tools such as zip, ditto and hdiutil used to stage data, especially when launched by Office apps, browsers or background daemons.
The thread through all three is context. Archiving is normal. Archiving started by a browser or a document reader, or done in a temp folder at night, is not.
How to reduce the risk
MITRE offers one mitigation: audit. Perform system scans to identify unauthorized archival utilities. That tells you which tools exist where they should not, so an unexpected copy of an archiver on a server is a lead on its own.
Quick check
Which three ways of archiving does MITRE split this technique into?
Using a utility, using a library, and using a custom method.
