MITRE ATT&CKsub-technique
T1560.002 Archive via Library
- Domain
- enterprise
- Tactics
- Collection
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 2020-02-20
Description
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data.
Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1560 Archive Collected Data technique
Tactic · MITRE ATT&CK (1)
- TA0009 Collection tactic
Referenced by MITRE ATT&CK · uses (16)
- G1057 ShinyHunters group
- S1141 LunarWeb software (malware)
- S1044 FunnyDream software (malware)
- S0661 FoggyWeb software (malware)
- S0642 BADFLICK software (malware)
- S0467 TajMahal software (malware)
- S0348 Cardinal RAT software (malware)
- S0352 OSX_OCEANLOTUS.D software (malware)
- S0354 Denis software (malware)
- S0260 InvisiMole software (malware)
- G0027 Threat Group-3390 group
- G0032 Lazarus Group group
- S0053 SeaDuke software (malware)
- S0086 ZLib software (malware)
- S0091 Epic software (malware)
- S0127 BBSRAT software (malware)
References
- https://libzip.org/ libzip
- https://github.com/madler/zlib Zlib Github
- https://pypi.org/project/rarfile/ PyPI RAR
- https://en.wikipedia.org/wiki/List_of_file_signatures Wikipedia File Header Signatures