T1560.001 Archive via Utility — Detection Rules

Source-backed rule directory

• Data Compressed · test · low · {"product":"linux","service":"auditd"}
• Disk Image Mounting Via Hdiutil - MacOS · test · medium · {"product":"macos","category":"process_creation"}
• Cisco Stage Data · test · low · {"product":"cisco","service":"aaa"}
• 7Zip Compressing Dump Files · test · medium · {"category":"process_creation","product":"windows"}
• Compress Data and Lock With Password for Exfiltration With 7-ZIP · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Manipulation Of Default Accounts Via Net.EXE · test · high · {"category":"process_creation","product":"windows"}
• Files Added To An Archive Using Rar.EXE · test · low · {"category":"process_creation","product":"windows"}
• Rar Usage with Password and Compression Level · test · high · {"category":"process_creation","product":"windows"}
• Compressed File Creation Via Tar.EXE · test · low · {"product":"windows","category":"process_creation"}
• Compressed File Extraction Via Tar.EXE · test · low · {"product":"windows","category":"process_creation"}
• Winrar Compressing Dump Files · test · medium · {"category":"process_creation","product":"windows"}
• WinRAR Execution in Non-Standard Folder · test · medium · {"category":"process_creation","product":"windows"}
• Compress Data and Lock With Password for Exfiltration With WINZIP · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0298 Detect Archiving via Utility (T1560.001)

AN0831 Analytic 0831

Detects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab, .zip, .7z, .rar). Identifies anomalous loading of crypt32.dll for encryption operations or execution of diantz.exe to compress remotely staged files.

AN0832 Analytic 0832

Detects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.

AN0833 Analytic 0833

Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip, .dmg, .tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.