tfMITRE ATT&CK sub-technique

Compression T1027.015

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 04 March 2025
Last modified: 12 May 2026
Contributor: Fernando Bacchin

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Compression MITRE reference T1027.015

Top 19%of all ATT&CK techniques for number of groups

10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has compressed their payloads by leveraging zip files.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

TA2541G1018 ↗

Has used compressed and char-encoded scripts in operations.1

created 2023-09-121 reference

HigaisaG0126 ↗

Used Base64 encoded compressed payloads.1 2

created 2021-03-052 references

MofangG0103 ↗

Has compressed the ShimRat executable within malicious email attachments.1

created 2020-05-121 reference

KimsukyG0094 ↗

Has delivered malicious payloads within Zip archives.1

created 2019-08-261 referenceaka Black Banshee

WIRTEG0090 ↗

Has compressed malicious files within RAR and ZIP archives for obfuscation. 1 2

created 2019-05-242 referencesaka Ashen Lepus

All 10 groups for this technique · 6 newest in this preview

Offense vs defense T1027.015

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Compression detection strategy DET0281

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Compressed Payload Creation and Execution

Enterprise

3 platforms

AN0782 · Windows

Monitors for compression tool usage (e.g., 7zip, WinRAR, MakeCab) that follows or precedes file modification, suspicious file types (e.g., .exe, .dll) being compressed, or dropped from self-extracting archives followed by immediate execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CompressedFileType	Zip, .rar, .cab, .gz – tune based on expected legitimate use of compression in environment
SFXExecutionDelay	Expected time between archive unpacking and first execution – short delays are suspicious
UserContext	Restrict detection to non-admin or interactive users if excessive FPs from sys admin activity

AN0783 · Linux

Detects sequential command-line compression utilities (e.g., gzip, tar, zip, 7z) followed by execution of unpacked files, especially in temp directories or under non-standard locations like /dev/shm or /tmp with ELF binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File CreationDC0039	auditd:SYSCALL	write
File AccessDC0055	auditd:SYSCALL	openat
File ModificationDC0061	auditd:SYSCALL	chmod

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PathRegex	Flag compressed archives extracted to /tmp, /dev/shm, or user’s home dir
CompressionToolPatterns	gzip, tar, bzip2, xz, 7z – tune to suppress admin packaging workflows
ExecutionAfterUnpackWindow	How soon a new file is executed after it’s unpacked

AN0784 · macOS

Identifies archive utilities (e.g., ditto, unzip, xar, pkgutil) used to extract payloads to non-standard paths, then correlates with execution or file permission changes (e.g., chmod +x) and process spawns from decompressed location.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process launch
File CreationDC0039	fs:fsusage	file open/write
File MetadataDC0059	macos:unifiedlog	filesystem events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DecompressionPathMatch	Target unusual extraction paths (~/Library/, /tmp/, /private/tmp/)
ToolBinaryNames	List of decompression utilities used in the environment
FollowOnExecutionDelta	Time between decompression and first binary execution

Compression detections T1027.015

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs