| name | T1560.002_archive-via-library |
| description | An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1560.002","collection","linux","macos","windows","sub-technique"] |
| technique_id | T1560.002 |
| tactic | collection |
| all_tactics | ["collection"] |
| platforms | ["Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1560/002 |
| tech_stack | ["linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1560","T1560.001","T1560.003"] |
| prerequisites | ["T1560"] |
| severity_boost | {"T1560":"Chain with T1560 for deeper attack path","T1560.001":"Chain with T1560.001 for deeper attack path","T1560.003":"Chain with T1560.003 for deeper attack path"} |
T1560.002 Archive via Library
Sub-technique of: T1560
High-Level Description
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data.
Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Kill Chain Phase
Platforms: Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Compressing data using GZip in Python (FreeBSD/Linux)
Uses GZip from Python to compress files
Supported Platforms: linux
which_python=`which python || which python3`
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"
Dependencies:
Atomic Test 2: Compressing data using bz2 in Python (FreeBSD/Linux)
Uses bz2 from Python to compress files
Supported Platforms: linux
which_python=` python || python3`
-c
