| name | T1532_archive-collected-data |
| description | Adversaries may compress and/or encrypt data that is collected prior to exfiltration. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","mobile","t1532","collection","android","ios"] |
| technique_id | T1532 |
| tactic | collection |
| all_tactics | ["collection"] |
| platforms | ["Android","iOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1532 |
| tech_stack | ["android","ios"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1532 Archive Collected Data
High-Level Description
Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm.
Kill Chain Phase
Platforms: Android, iOS
What to Check
How to Test
Identify Attack Surface
Determine if the target mobile environment is susceptible to Archive Collected Data by examining the target platforms (Android, iOS).
Assess Existing Defenses
Review whether mitigations for T1532 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection of Archive Collected Data
Risk Assessment
| Finding | Severity | Impact |
|---|
| Archive Collected Data technique applicable | Medium | Collection |
CWE Categories
| CWE ID | Title |
|---|
| CWE-200 | Exposure of Sensitive Information |
References
