القائمة
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1560-001-archive-via-utilityيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | T1560.001_archive-via-utility |
| description | Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1560.001","collection","linux","macos","windows","sub-technique"] |
| technique_id | T1560.001 |
| tactic | collection |
| all_tactics | ["collection"] |
| platforms | ["Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1560/001 |
| tech_stack | ["linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1560","T1560.002","T1560.003"] |
| prerequisites | ["T1560"] |
| severity_boost | {"T1560":"Chain with T1560 for deeper attack path","T1560.002":"Chain with T1560.002 for deeper attack path","T1560.003":"Chain with T1560.003 for deeper attack path"} |
Sub-technique of: T1560
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.
On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging). xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.
Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory
Supported Platforms: windows
"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}
Dependencies:
Note: Requires winrar installation rar a -p"blue" hello.rar (VARIANT)
Supported Platforms: windows
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{rar_exe}" a -hp"blue" hello.rar
dir
Dependencies:
Note: Requires winzip installation wzzip sample.zip -s"blueblue" *.txt (VARIANT)
Supported Platforms: windows
path=%path%;"C:\Program Files (x86)\winzip"
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{winzip_exe}" -min -a -s"hello" archive.zip *
dir
Dependencies:
Note: This test requires 7zip installation
Supported Platforms: windows
mkdir $PathToAtomicsFolder\T1560.001\victim-files
cd $PathToAtomicsFolder\T1560.001\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{7zip_exe}" u archive.7z *txt -pblue
dir
Dependencies:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.
Supported Platforms: linux, macos Elevation Required: Yes
zip #{output_file} #{input_files}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Archive via Utility by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1560.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
System scans can be performed to identify unauthorized archival utilities.
| Finding | Severity | Impact |
|---|---|---|
| Archive via Utility technique applicable | Low | Collection |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |