T1560.002 — Archive via Library

Tactic: Collection · Platforms: Linux, macOS, Windows

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile, libzip, and zlib. Most libraries include functionality to encrypt and/or compress data. Some archival libraries are…

Sub-technique of Archive Collected Data (T1560).

Sigma detection rules (3)

title: "T1560.002 Archive Collected Data: Archive via Library"
id: d196763e-ba4f-40ea-9e6b-cfa6921d3858
description: 'Detects processes loading common archival/compression library DLLs (zlib, libzip, bzip2, lzma, unrar) that may be used programmatically to compress or encrypt collected data prior to exfiltration. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: LibraryAllowlist, SuspiciousExtensions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1560/002
author: Shahrukh Khan
date: 2026-04-24
license: MIT
tags:
  - attack.collection
  - attack.t1560.002

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 7
    ImageLoaded|endswith:
      - '\zlib1.dll'
      - '\zlibwapi.dll'
      - '\libzip.dll'
      - '\libbz2.dll'
      - '\bz2.dll'
      - '\lzma.dll'
      - '\unrar.dll'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate applications statically or dynamically linking these common compression libraries.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1560.002 Archive Collected Data: Archive via Library"
id: 98a16b5d-46e2-46ad-82a9-077e9dabc9b1
description: 'Detect Archiving via Library (T1560.002). Auditd process telemetry cannot see dlopen()/library-linkage of standard system compression libraries, so this rule uses two weak proxies: (1) scripted argv references to library names in python3/perl invocations, and (2) PATH records showing compression shared objects (libz.so, libbz2.so, liblzma.so, libzstd.so) loaded from non-standard, writable staging directories (/tmp, /var/tmp, /dev/shm), which suggests a dropped/staged library rather than routine system linkage. Tune using: MonitoredLibraries, ArchivePaths, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1560/002
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.collection
  - attack.t1560.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_argv:
    type: EXECVE
    a0|endswith:
      - '/python3'
      - '/perl'
    a1|contains:
      - 'zlib'
      - 'gzip.GzipFile'
  selection_libload_path:
    type: PATH
    name|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
    nametype: NORMAL
  selection_libload_name:
    name|contains:
      - 'libz.so'
      - 'libbz2.so'
      - 'liblzma.so'
      - 'libzstd.so'

  condition: selection_argv or (selection_libload_path and selection_libload_name)

falsepositives:
  - 'Archiving performed by linking a compression library (zlib/libbz2) inside a process rather than shelling out is largely invisible to auditd''s process telemetry, since dlopen()/library-linkage events against standard system library paths (/usr/lib, /lib) are not captured; this rule only catches scripted argv references to the library name (weak, easily evaded) and loads of compression shared objects staged in non-standard, world-writable directories (/tmp, /var/tmp, /dev/shm), which will miss library-based archiving using unmodified system libraries.'
  - 'Legitimate software occasionally unpacks or stages its own bundled shared libraries under /tmp or /dev/shm during installation or self-extraction; correlate with EntropyThreshold/ArchivePaths and process lineage before treating as malicious.'

level: low

title: "T1560.002 Archive Collected Data: Archive via Library"
id: cfbd8fa3-5cc8-4bc5-bd2e-9c745e9cb341
description: 'Detect Archiving via Library (T1560.002). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedProcesses, UserContext, FileExtensionFilter.'
references:
  - https://attack.mitre.org/techniques/T1560/002
author: Shahrukh Khan
date: 2026-03-30
license: MIT
tags:
  - attack.collection
  - attack.t1560.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/python3'
    CommandLine|contains:
      - 'zipfile'
      - 'shutil.make_archive'
      - 'ZipFile'

  condition: selection

falsepositives:
  - Legitimate Python-based backup or packaging scripts that use the standard library zipfile module; command line arguments rarely reveal in-script library calls so this only catches inline one-liners.

level: medium

Related sub-techniques

• T1560.003 Archive via Custom Method
• T1560.001 Archive via Utility

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1560.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan