cyberstrikeus T1532 Archive Collected Data
High-Level Description
Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm.
Kill Chain Phase
- Collection (TA0035)
Platforms: Android, iOS
What to Check
- Identify if Archive Collected Data technique is applicable to target mobile environment
- Check Android devices for indicators of Archive Collected Data
- Check iOS devices for indicators of Archive Collected Data
- Assess detection coverage (1 detection strategies)
How to Test
Identify Attack Surface
Determine if the target mobile environment is susceptible to Archive Collected Data by examining the target platforms (Android, iOS).
Assess Existing Defenses
Review whether mitigations for T1532 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection of Archive Collected Data
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Archive Collected Data technique applicable | Medium | Collection |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |