CmdID

CmdID / Techniques

T1560 Archive Collected Data

An adversary may compress and/or encrypt data that is collected prior to exfiltration. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1560 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1560.001Archive Collected Data: Archive via Utility

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
tar.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highConti NTDS Exfiltration CommandMax Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · Windows
lowCompressed File Creation Via Tar.EXENasreddine Bencherchali (Nextron Systems), AdmU3 · Windows
lowCompressed File Extraction Via Tar.EXEAdmU3 · Windows