T1560.003 — Archive via Custom Method

Tactic: Collection · Platforms: Linux, macOS, Windows

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of…

Sub-technique of Archive Collected Data (T1560).

Sigma detection rules (3)

title: "T1560.003 Archive Collected Data: Archive via Custom Method"
id: f914d03f-e222-4a3e-84ef-8bee5f91bdbe
description: 'Detects scripting engines (PowerShell, WScript/CScript, Python, cmd) writing files with non-standard archive/staging extensions (.bin, .dat, .enc, .xor, .b64) - a proxy for custom (non-library) archive/encryption methods used prior to exfiltration, since content-level entropy/compression cannot be evaluated from Sigma event fields alone. (Data Component: File Creation.) Tune using: ExtensionList, TrustedScriptPaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1560/003
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.collection
  - attack.t1560.003

logsource:
  category: file_event
  product: windows

detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\cmd.exe'
    TargetFilename|endswith:
      - '.bin'
      - '.dat'
      - '.enc'
      - '.xor'
      - '.b64'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate scripts that write .dat/.bin configuration or cache files; tune extension list and script paths to the environment.

level: medium

title: "T1560.003 Archive Collected Data: Archive via Custom Method"
id: e66cbd48-3fc9-4400-8196-8859eb502a54
description: 'Detect Archiving via Custom Method (T1560.003). The original rule matched openssl enc -aes (a standard utility/library) and base64 (not archival at all), the opposite of a "custom method with no external library reference". A genuinely custom in-process XOR/stream-cipher routine leaves no distinguishing argv signature and cannot be reliably observed via auditd process-creation telemetry alone; this rule instead implements the closest defensible Linux-observable proxy: execution of binaries/scripts staged from world-writable temp directories or run as hidden dotfiles, which is common for adversary-supplied custom tooling. Tune using: ArchivePaths, ScriptAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1560/003
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.collection
  - attack.t1560.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_susp_tmp_exec:
    type: EXECVE
    a0|re: '^(/tmp|/dev/shm|/var/tmp)/[^/]+
    
  


  selection_hidden_exec:
    type: EXECVE
    a0|re: '.*/\.[^/]+
    
  



  condition: 1 of selection_*

falsepositives:
  - Legitimate ad hoc scripts and installer helper binaries staged in /tmp or /dev/shm by package managers, CI runners, or container init processes; this proxy cannot confirm a custom bitwise/stream-cipher archival routine is actually running, since that logic executes inside the process rather than appearing in argv.

level: low

title: "T1560.003 Archive Collected Data: Archive via Custom Method"
id: 38189976-3c3e-4a6c-a7fa-c672aa8eac6e
description: 'Detect Archiving via Custom Method (T1560.003). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, EntropyThreshold, AllowedApps.'
references:
  - https://attack.mitre.org/techniques/T1560/003
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.collection
  - attack.t1560.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/openssl'
    CommandLine|contains|all:
      - 'enc'
      - '-aes'

  condition: selection

falsepositives:
  - Administrators or scripts using openssl to encrypt legitimate backup archives before transferring them offsite.

level: medium

Related sub-techniques

• T1560.002 Archive via Library
• T1560.001 Archive via Utility

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1560.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan