T1560.001Collection
Archive via Utility
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
17 Sigma rules tagged T1560.001Archive via UtilityT1560.00117 general rules
- APT31 Judgement Panda Activitycriticaltest
- Rar Usage with Password and Compression Levelhightest
- Suspicious Manipulation Of Default Accounts Via Net.EXEhightest
- LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental
- 7Zip Compressing Dump Filesmediumtest
- Compress Data and Lock With Password for Exfiltration With 7-ZIPmediumtest
- Compress Data and Lock With Password for Exfiltration With WINZIPmediumtest
- Disk Image Mounting Via Hdiutil - MacOSmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Archive via Utility
2 CVEs, by priority. Each link shows its badge.- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.0%Top 0.07%83.7priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 moreMITRE CTID mapping of the KEV entry · follow-on activity93.3%Top 0.16%69.8priority