1200KM / simulation
T1560.002 Archive via Library — Attack Simulation
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries…
Technique description
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Compressing data using zipfile in Python (FreeBSD/Linux)
Procedure 001a042b-859f-44d9-bf81-fd1c4e2200b0; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Compressing data using GZip in Python (FreeBSD/Linux)
Procedure 391f5298-b12d-4636-8482-35d9c17d53a8; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Compressing data using bz2 in Python (FreeBSD/Linux)
Procedure c75612b2-9de0-4d7c-879c-10d7b077072d; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Compressing data using tarfile in Python (FreeBSD/Linux)
Procedure e86f1b4b-fcc1-4a2a-ae10-b49da01458db; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.