T1560.001 Archive Collected Data: Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. MITRE ATT&CK

1 program on CmdID 15 Sigma rules T1560.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1560Archive Collected Data

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

criticalAPT31 Judgement Panda ActivityFlorian Roth (Nextron Systems) · Windows

highLiteLLM / TeamPCP Supply Chain Attack IndicatorsSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

highSuspicious Manipulation Of Default Accounts Via Net.EXENasreddine Bencherchali (Nextron Systems) · Windows

medium7Zip Compressing Dump FilesNasreddine Bencherchali (Nextron Systems) · Windows

mediumDisk Image Mounting Via Hdiutil - MacOSOmar Khaled (@beacon_exe) · macOS

mediumPotentially Suspicious Compression Tool ParametersFlorian Roth (Nextron Systems), Samir Bousseaden · Windows

mediumWinrar Compressing Dump FilesFlorian Roth (Nextron Systems) · Windows

mediumWinRAR Execution in Non-Standard FolderFlorian Roth (Nextron Systems), Tigzy · Windows

lowCompressed File Creation Via Tar.EXENasreddine Bencherchali (Nextron Systems), AdmU3 · Windows

lowFiles Added To An Archive Using Rar.EXETimur Zinniatullin, E.M. Anhaus, oscd.community · Windows

lowPassword Protected Compressed File Extraction Via 7ZipNasreddine Bencherchali (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

Mount an image on the page for hdiutil

hdiutil attach path/to/image_fileIdentify

An example is here when CmdID’s reading of it names T1560.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.