T1560.001 — Archive via Utility

Tactic: Collection · Platforms: Linux, macOS, Windows

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or…

Sub-technique of Archive Collected Data (T1560).

Sigma detection rules (3)

T1560.001 Archive Collected Data: Archive via Utility

title: "T1560.001 Archive Collected Data: Archive via Utility"
id: f24bdd03-bb51-4953-8423-25a0aebc9f13
description: 'Detects common archive/compression utilities (7-Zip, WinRAR, tar, makecab/diantz) creating archive files, often used to package collected data prior to exfiltration. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: SuspiciousExtensions, ProcessAllowlist, FileSizeThresholdMB.'
references:
  - https://attack.mitre.org/techniques/T1560/001
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.collection
  - attack.t1560.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\rar.exe'
      - '\winrar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\zip.exe'
      - '\makecab.exe'
      - '\diantz.exe'
      - '\tar.exe'

  selection_ext:
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.cab'
      - '.tar'
      - '.gz'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_ext and not filter_system_account

falsepositives:
  - Legitimate use of archive utilities for backups, software packaging, or log rotation.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1560.001 Archive Collected Data: Archive via Utility

title: "T1560.001 Archive Collected Data: Archive via Utility"
id: f275e31a-8a29-4ae0-8aa8-aaba82c0d72e
description: 'Detect Archiving via Utility (T1560.001) staged in temporary/shared-memory directories commonly used for pre-exfiltration collection staging. Dropped the overly broad ''/home/'' directory match, since matching any tar/zip/gzip/bzip2 invocation touching a user''s home directory fires on nearly all routine user archiving. Tune using: ArchiveCommands, MonitoredDirectories, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1560/001
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.collection
  - attack.t1560.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/tar'
      - '/zip'
      - '/gzip'
      - '/bzip2'
  selection_dir:
    a1|contains:
      - '/tmp/'
      - '/dev/shm/'

  condition: all of selection*

falsepositives:
  - Legitimate deployment/backup tooling using tar/gzip/zip/bzip2 against /tmp or /dev/shm for scratch space; the logsource is process_creation (auditd EXECVE), so this cannot distinguish staging for exfiltration from routine build/CI archive use without further correlation.

level: medium

T1560.001 Archive Collected Data: Archive via Utility

title: "T1560.001 Archive Collected Data: Archive via Utility"
id: 9a98866c-3a03-4f97-ae3c-ddeb7d5bc926
description: 'Detect Archiving via Utility (T1560.001). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedArchivers, UserContext, PayloadEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1560/001
author: Shahrukh Khan
date: 2026-03-20
license: MIT
tags:
  - attack.collection
  - attack.t1560.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/zip'
      - '/tar'
      - '/ditto'
    CommandLine|contains|all:
      - '-r'

  condition: selection

falsepositives:
  - Developers or backup scripts creating zip or tar archives of project directories as part of normal workflow.

level: medium

Related sub-techniques

Explore