MITRE ATT&CKsub-technique

T1560.003 Archive via Custom Method

Published 2020-02-20 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.0
Created
2020-02-20

Description

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1560 Archive Collected Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (39)

  • G1048 UNC3886 group
  • S1059 metaMain software (malware)
  • C0017 C0017 campaign
  • S1044 FunnyDream software (malware)
  • S1042 SUGARDUMP software (malware)
  • S1030 Squirrelwaffle software (malware)
  • S0661 FoggyWeb software (malware)
  • S0657 BLUELIGHT software (malware)
  • S0615 SombRAT software (malware)
  • G0129 Mustang Panda group
  • S0603 Stuxnet software (malware)
  • S0503 FrameworkPOS software (malware)
  • S0491 StrongPity software (malware)
  • S0458 Ramsay software (malware)
  • S0448 Rising Sun software (malware)
  • S0443 MESSAGETAP software (malware)
  • S0438 Attor software (malware)
  • S0439 Okrum software (malware)
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0391 HAWKBALL software (malware)
  • S0352 OSX_OCEANLOTUS.D software (malware)
  • S0258 RGDoor software (malware)
  • S0260 InvisiMole software (malware)
  • S0264 OopsIE software (malware)
  • S0198 NETWIRE software (malware)
  • G0052 CopyKittens group
  • S0169 RawPOS software (malware)
  • S0172 Reaver software (malware)
  • G0030 Lotus Blossom group
Show all 39 ›

References