{"id":"T1560","name":"Archive Collected Data","url":"https://attack.mitre.org/techniques/T1560","tactics":["collection"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0526","stix_id":"x-mitre-detection-strategy--043bc738-1f07-4d28-9f5c-1b1f81525e7c","name":"Detect Archiving and Encryption of Collected Data (T1560)","url":"https://attack.mitre.org/detectionstrategies/DET0526","analytics":[{"id":"AN1458","stix_id":"x-mitre-analytic--eaeb2a44-eebe-41f3-875a-a34abdc03252","name":"Analytic 1458","description":"Detects adversarial archiving of files prior to exfiltration by correlating execution of compression/encryption utilities (e.g., makecab.exe, rar.exe, 7z.exe, powershell Compress-Archive) with subsequent creation of large compressed or encrypted files. Identifies abnormal process lineage involving crypt32.dll usage, command-line arguments invoking compression switches, and file write operations to temporary or staging directories.","url":"https://attack.mitre.org/detectionstrategies/DET0526#AN1458","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ArchiveExtensions","description":"List of file extensions treated as suspicious when created outside of expected paths."},{"field":"ProcessAllowlist","description":"Known business processes permitted to use compression/encryption utilities."},{"field":"FileSizeThresholdMB","description":"Minimum file size for flagging archive creation to reduce noise from benign small compressions."}],"live":true,"detection_strategies":["DET0526"],"techniques":["T1560"]},{"id":"AN1459","stix_id":"x-mitre-analytic--8018e3a6-ab64-4fe2-9771-ca129091bc17","name":"Analytic 1459","description":"Detects adversarial archiving activity through invocation of utilities like tar, gzip, bzip2, or openssl used in non-administrative or unusual contexts. Correlates command execution patterns with file creation of compressed/encrypted outputs in staging directories (e.g., /tmp, /var/tmp).","url":"https://attack.mitre.org/detectionstrategies/DET0526#AN1459","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: Execution of tar, gzip, bzip2, or openssl with output redirection","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:FILE","channel":"create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-file"}],"mutable_elements":[{"field":"ArchiveCommands","description":"List of archiving/encryption utilities considered sensitive in the monitored environment."},{"field":"SuspiciousDirectories","description":"Paths where archive creation is suspicious (e.g., /tmp, user home directories)."},{"field":"TimeWindow","description":"Temporal window to correlate command execution with file creation events."}],"live":true,"detection_strategies":["DET0526"],"techniques":["T1560"]},{"id":"AN1460","stix_id":"x-mitre-analytic--0f4789c9-7946-473f-967b-e8ca59fa3c8c","name":"Analytic 1460","description":"Detects use of macOS-native archiving or encryption tools (zip, ditto, hdiutil) for staging collected data. Identifies unexpected invocation of archive utilities by Office apps, browsers, or background daemons. Correlates file creation of .zip/.dmg containers with process lineage anomalies.","url":"https://attack.mitre.org/detectionstrategies/DET0526#AN1460","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Creation of .zip or .dmg files in user-accessible or temporary directories","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AllowedArchiveUtilities","description":"Business-approved applications (e.g., Time Machine, backup agents) that generate archives."},{"field":"UserContext","description":"Threshold for flagging archive creation under privileged or service accounts."},{"field":"PayloadEntropyThreshold","description":"Entropy threshold for detecting encrypted archives versus standard compressed files."}],"live":true,"detection_strategies":["DET0526"],"techniques":["T1560"]}],"live":true,"version":"1.0","techniques":["T1560"]}],"sigma_rules":[{"id":"418a3163-3247-4b7b-9933-dcfcb7c52ea9","title":"Compressed File Creation Via Tar.EXE","author":"Nasreddine Bencherchali (Nextron Systems), AdmU3","status":"test","level":"low","date":"2023-12-19","modified":null,"description":"Detects execution of \"tar.exe\" in order to create a compressed file.\nAdversaries may abuse various utilities to compress or encrypt data before exfiltration.\n","references":["https://unit42.paloaltonetworks.com/chromeloader-malware/","https://lolbas-project.github.io/lolbas/Binaries/Tar/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.exfiltration","attack.t1560","attack.t1560.001"],"path":"rules/windows/process_creation/proc_creation_win_tar_compression.yml","techniques":["T1560","T1560.001"],"cves":[]},{"id":"6dc5d284-69ea-42cf-9311-fb1c3932a69a","title":"Compress-Archive Cmdlet Execution","author":"Timur Zinniatullin, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2023-12-15","description":"Detects PowerShell scripts that make use of the \"Compress-Archive\" cmdlet in order to compress folders and files.\nAn adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.exfiltration","attack.collection","attack.t1560","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_compress_archive_usage.yml","techniques":["T1560"],"cves":[]},{"id":"aa92fd02-09f2-48b0-8a93-864813fb8f41","title":"Conti NTDS Exfiltration Command","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2022-10-09","description":"Detects a command used by conti to exfiltrate NTDS","references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1560","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_7zip.yml","techniques":["T1560"],"cves":[]},{"id":"bf361876-6620-407a-812f-bfe11e51e924","title":"Compressed File Extraction Via Tar.EXE","author":"AdmU3","status":"test","level":"low","date":"2023-12-19","modified":null,"description":"Detects execution of \"tar.exe\" in order to extract compressed file.\nAdversaries may abuse various utilities in order to decompress data to avoid detection.\n","references":["https://unit42.paloaltonetworks.com/chromeloader-malware/","https://lolbas-project.github.io/lolbas/Binaries/Tar/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.exfiltration","attack.t1560","attack.t1560.001"],"path":"rules/windows/process_creation/proc_creation_win_tar_extraction.yml","techniques":["T1560","T1560.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}