{"id":"a3b5e3e9-1b49-4119-8b8e-0344a01f21ee","title":"Data Compressed","description":"An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.","author":"Timur Zinniatullin, oscd.community","status":"test","level":"low","date":"2019-10-21","modified":"2023-07-28","tags":["attack.exfiltration","attack.collection","attack.t1560.001"],"technique_ids":["T1560.001"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Legitimate use of archiving tools by legitimate user."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md"],"source_path":"rules/linux/auditd/execve/lnx_auditd_data_compressed.yml","source_sha256":"128191e589c1462d01c76513d90109cf069ee0cef82979c72ab562279ecef556","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_data_compressed.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Data Compressed\nid: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee\nstatus: test\ndescription: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2023-07-28\ntags:\n    - attack.exfiltration\n    - attack.collection\n    - attack.t1560.001\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection1:\n        type: 'execve'\n        a0: 'zip'\n    selection2:\n        type: 'execve'\n        a0: 'gzip'\n        a1: '-k'\n    selection3:\n        type: 'execve'\n        a0: 'tar'\n        a1|contains: '-c'\n    condition: 1 of selection*\nfalsepositives:\n    - Legitimate use of archiving tools by legitimate user.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1560.001","id":"T1560.001","name":"Archive via Utility","page":"techniques/enterprise/T1560.001/"}],"data_path":"data/detection-rules/a3b5e3e9-1b49-4119-8b8e-0344a01f21ee.json","kind":"sigma"}