MITRE ATT&CKsub-technique

T1560.001 Archive via Utility

Published 2020-02-20 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.3
Created
2020-02-20

Description

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging). xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1560 Archive Collected Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

Referenced by MITRE ATT&CK · uses (89)

  • S9052 MiniFast software (malware)
  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • G1055 VOID MANTICORE group
  • G1054 MirrorFace group
  • S9010 GlassWorm software (malware)
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1239 TONESHELL software (malware)
  • S1228 PUBLOAD software (malware)
  • G1048 UNC3886 group
  • S1210 Sagerunex software (malware)
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • S1168 SampleCheck5000 software (malware)
  • G1041 Sea Turtle group
  • G1040 Play group
  • G1039 RedCurl group
  • C0040 APT41 DUST campaign
  • S1141 LunarWeb software (malware)
  • G1032 INC Ransom group
  • G1030 Agrius group
  • C0029 Cutting Edge campaign
  • G1024 Akira group
  • G1023 APT5 group
  • G1022 ToddyCat group
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
Show all 89 ›

Referenced by Compliance · mitigates (5)

  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References