BlackByteG1043 ↗
Compressed data collected from victim environments prior to exfiltration.1
tfMITRE ATT&CK technique
Archive Collected Data T1560
- Tactic
- Collection
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 20 February 2020
- Last modified
- 12 May 2026
Sub-techniques 327 rules across the family · 7 mapped directly to T1560 · 1 of 3 carry rules
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.[1] Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
13
Threat groupsTop 14%
Threat groups86th percentile · 85% of ATT&CK techniques have fewer threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.44
Tools & malwareTop 9%
Tools & malware91st percentile · 91% of ATT&CK techniques have fewer tools implementing them.7
Detection rules69th pct
Detection rules69th percentile · 67% of ATT&CK techniques have fewer detection rules written.