MITRE ATT&CKtechnique

T1560 Archive Collected Data

Published 2020-02-20 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.0
Created
2020-02-20

Description

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1560.001 Archive via Utility sub-technique
  • T1560.002 Archive via Library sub-technique
  • T1560.003 Archive via Custom Method sub-technique

Referenced by MITRE ATT&CK · uses (57)

  • S9043 Mini Shai-Hulud software (malware)
  • S9036 LP-Notes software (malware)
  • S9032 MuddyViper software (malware)
  • S1206 JumbledPath software (malware)
  • S1196 Troll Stealer software (malware)
  • G1043 BlackByte group
  • S1148 Raccoon Stealer software (malware)
  • S1140 Spica software (malware)
  • S1101 LoFiSe software (malware)
  • G1014 LuminousMoth group
  • S1039 Bumblebee software (malware)
  • G1003 Ember Bear group
  • S1012 PowerLess software (malware)
  • S0681 Lizar software (malware)
  • S0667 Chrommme software (malware)
  • S0658 XCSSET software (malware)
  • S0657 BLUELIGHT software (malware)
  • S0622 AppleSeed software (malware)
  • S0586 TAINTEDSCRIBE software (malware)
  • S0567 Dtrack software (malware)
  • S0521 BloodHound software (tool)
  • S0515 WellMail software (malware)
  • S0517 Pillowmint software (malware)
  • S0487 Kessel software (malware)
  • S0456 Aria-body software (malware)
  • S0454 Cadelspy software (malware)
  • S0445 ShimRatReporter software (tool)
  • S0409 Machete software (malware)
  • S0395 LightNeuron software (malware)
  • S0375 Remexi software (malware)
Show all 57 ›

Referenced by Compliance · mitigates (5)

  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References