UNC3886G1048 ↗
Has XOR encrypted and Gzip compressed captured credentials.1
tfMITRE ATT&CK sub-technique
Archive via Custom Method T1560.003
sub-technique of T1560 Archive Collected Data
- Tactic
- Collection
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 20 February 2020
- Last modified
- 24 October 2025
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.31
Tools & malwareTop 12%
Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Archive via Custom Method MITRE reference T1560.003
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Mustang PandaG0129 ↗
Has encrypted documents with RC4 prior to exfiltration.1
KimsukyG0094 ↗
Has used RC4 encryption before exfil.1
CopyKittensG0052 ↗
Encrypts data with a substitute cipher prior to exfiltration.1
FIN6G0037 ↗
Has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.12
Lazarus GroupG0032 ↗
A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.1234
All 7 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
31 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
metaMainS1059 ↗
Has used XOR-based encryption for collected files before exfiltration.1
FunnyDreamS1044 ↗
Has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or qwerasdf if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.1
SUGARDUMPS1042 ↗
Has encrypted collected data using AES CBC mode and encoded it using Base64.1
SquirrelwaffleS1030 ↗
Has encrypted collected data using a XOR-based algorithm.1
FoggyWebS0661 ↗
Can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.1
BLUELIGHTS0657 ↗
Has encoded data into a binary blob using XOR.1
All 31 software entries for this technique · 6 newest in this preview
Offense vs defense T1560.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Archive via Custom Method detection strategy DET0438
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Archiving via Custom Method (T1560.003)
3 platforms
AN1213 · Windows
Detects suspicious custom compression/encryption routines through anomalous script or binary execution that produces high-entropy files without standard archiving utilities. Correlates script execution, memory API usage (bitwise ops, CryptoAPI calls), and creation of archive-like files with uncommon headers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EntropyThreshold | Minimum entropy level that flags suspicious custom archives. |
| AllowedProcesses | Known business processes performing encryption or compression. |
| TimeWindow | Correlation timeframe between script execution and file creation. |
AN1214 · Linux
Detects custom archive routines by correlating script execution (Python, Perl, Bash) with creation of high-entropy files in temporary or user directories. Flags processes performing unusual bitwise operations or writing files without standard compression headers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | linux:osquery | Detection of bitwise operations or custom encryption functions in memory traces |
| File CreationDC0039 | auditd:FILE | create: Creation of files with anomalous headers and entropy levels in /tmp or user directories |
| Command ExecutionDC0064 | auditd:SYSCALL | execve: Execution of interpreters creating archive-like outputs without calling tar/gzip |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ArchivePaths | Directories monitored for anomalous archive creation (e.g., /tmp, /home). |
| EntropyThreshold | Entropy score to flag files lacking recognizable compression headers. |
| ScriptAllowlist | Scripts/processes known to use custom compression methods. |
AN1215 · macOS
Detects custom archiving by monitoring execution of Swift/Objective-C apps or scripts producing high-entropy files with non-standard headers. Correlates unified logs of abnormal NSFileHandle/NSData operations, memory use of XOR/bitwise operations, and file creation events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | macos:unifiedlog | Abnormal memory operations (XOR/bitwise loops) during archive generation |
| Process CreationDC0032 | macos:unifiedlog | Suspicious Swift/Objective-C or scripting processes writing archive-like outputs |
| File CreationDC0039 | macos:unifiedlog | Creation of files with anomalous headers and entropy values |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Flag if archiving occurs under privileged/system accounts. |
| EntropyThreshold | Entropy score cutoff for identifying custom compressed or encrypted files. |
| AllowedApps | Applications legitimately using custom archiving for business purposes. |