tfMITRE ATT&CK sub-technique

Archive via Library T1560.002

sub-technique of T1560 Archive Collected Data

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 20 February 2020
Last modified: 24 October 2025

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile [1], libzip [2], and zlib [3]. Most libraries include functionality to encrypt and/or compress data.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 23%

Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Archive via Library MITRE reference T1560.002

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used the following command to compress collected data: pv -s "$(du -sb exfil | awk '{print $1}')" | zstd -3 -T0 -o exfil.tar.zst .1

created 2026-07-291 referenceaka UNC6240

Lazarus GroupG0032 ↗

Malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

Threat Group-3390G0027 ↗

Has used RAR to compress, encrypt, and password-protect files prior to exfiltration.1

created 2017-05-311 referenceaka Earth Smilodon

All 3 groups for this technique

13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LunarWebS1141 ↗

Can zlib-compress data prior to exfiltration.1

created 2024-06-26MALWAREcarried by 1 group

FunnyDreamS1044 ↗

Has compressed collected files with zLib.1

created 2022-09-23MALWARE

FoggyWebS0661 ↗

Can invoke the Common.Compress method to compress data with the C# GZipStream compression class.1

created 2021-11-16MALWAREcarried by 1 group

BADFLICKS0642 ↗

Has compressed data using the aPLib compression library.1

created 2021-08-26MALWAREcarried by 1 group

TajMahalS0467 ↗

Has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.1

created 2020-06-08MALWARE

DenisS0354 ↗

Compressed collected data using zlib.1

created 2019-01-30MALWAREcarried by 1 group

All 13 software entries for this technique · 6 newest in this preview

Offense vs defense T1560.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Archive via Library detection strategy DET0268

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Archiving via Library (T1560.002)

Enterprise

3 platforms

AN0747 · Windows

Detects adversarial archiving using libraries (zlib, zip APIs) invoked by scripts or binaries. Correlates process executions of Python, PowerShell, or custom .NET binaries with DLL/module loads linked to compression libraries, followed by archive file creation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LibraryAllowlist	Known business applications using compression libraries.
SuspiciousExtensions	Archive extensions considered sensitive in monitored environments.
TimeWindow	Correlation window between script/library invocation and file creation.

AN0748 · Linux

Detects adversarial archiving by scripts or binaries calling compression libraries (libzip, zlib, bzip2). Correlates execution of Python, Perl, or compiled binaries with dynamic linking to archiving libraries and creation of compressed files in /tmp or user directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	auditd:MMAP	load: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving
File CreationDC0039	auditd:FILE	create: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of python, perl, or custom binaries invoking compression libraries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredLibraries	List of shared objects linked to compression/encryption.
ArchivePaths	Directories where archive creation is flagged as anomalous.
EntropyThreshold	Entropy level used to distinguish encryption from normal compression.

AN0749 · macOS

Detects malicious archiving via system or third-party libraries (libz, libarchive) invoked by Python, Swift, or Objective-C binaries. Correlates unified logs of library loads with creation of compressed or encrypted archives (.zip, .gz, .bz2, .dmg).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	Loading of libz.dylib, libarchive.dylib by non-standard applications
Process CreationDC0032	macos:unifiedlog	Execution of Python, Swift, or other binaries invoking archiving libraries
File CreationDC0039	macos:unifiedlog	Creation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedProcesses	Applications allowed to load compression libraries (e.g., backup agents).
UserContext	Flag archiving under privileged or system accounts as suspicious.
FileExtensionFilter	Targeted monitoring of sensitive file formats or compressed containers.

Tests4Executorssh 4Need elevation0 of 4Have prerequisites4Have cleanup4Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Compressing data using GZip in Python (FreeBSD/Linux)

linux

—

Yes

Uses GZip from Python to compress files

Input arguments

Name	Type	Default	Description
path_to_input_file	path	/etc/passwd	Path to the file that you want to compress
path_to_output_file	path	/tmp/passwd.gz	Path of the file that you want your .gz file to be

Attack command

which_python=`which python || which python3`
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"

Cleanup command

rm #{path_to_output_file}

Prerequisite

Requires Python

Check

which python || which python3

Satisfy

echo "please install python to run this test"; exit 1

GUID0f7e1ed1-a41b-4e8e-910d-0628b63d1ee6

Compressing data using bz2 in Python (FreeBSD/Linux)

linux

—

Yes

Uses bz2 from Python to compress files

Input arguments

Name	Type	Default	Description
path_to_input_file	path	/etc/passwd	Path to the file that you want to compress
path_to_output_file	path	/tmp/passwd.bz2	Path of the file that you want your .bz2 file to be

Attack command

which_python=`which python || which python3`
$which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(str(bz2content));output_file.close();"

Cleanup command

rm #{path_to_output_file}

Prerequisite

Requires Python

Check

which python || which python3

Satisfy

echo "please install python to run this test"; exit 1

GUIDf32e1bed-cc74-4368-b73b-5fdecf113882

Compressing data using zipfile in Python (FreeBSD/Linux)

linux

—

Yes

Uses zipfile from Python to compress files

Input arguments

Name	Type	Default	Description
path_to_input_file	path	/etc/passwd	Path to the file that you want to compress
path_to_output_file	path	/tmp/passwd.zip	Path of the file that you want your .zip file to be

Attack command

which_python=`which python || which python3`
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"

Cleanup command

rm #{path_to_output_file}

Prerequisite

Requires Python

Check

which python || which python3

Satisfy

echo "please install python to run this test"; exit 1

GUID278dbfb7-1fc7-4c94-a8fa-c92ffaf9a125

Compressing data using tarfile in Python (FreeBSD/Linux)

linux

—

Yes

Uses tarfile from Python to compress files

Input arguments

Name	Type	Default	Description
path_to_input_file	path	/etc/passwd	Path to the file that you want to compress
path_to_output_file	path	/tmp/passwd.tar.gz	Path of the file that you want your .tar.gz file to be

Attack command

which_python=`which python || which python3`
$which_python -c "import tarfile; output_file = tarfile.open('#{path_to_output_file}','w'); output_file.add('#{path_to_input_file}'); output_file.close()"

Cleanup command

rm #{path_to_output_file}

Prerequisite

Requires Python

Check

which python || which python3

Satisfy

echo "please install python to run this test"; exit 1

GUIDad7d1394-8d3e-4c6f-b23e-13bffb779cf1

Tests from Atomic Red Team (MIT licence) · technique definition

Archive via Library detections T1560.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs