T1560.001_archive-via-utility

T1560.001 Archive via Utility

Sub-technique of: T1560

High-Level Description

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.

On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging). xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.

Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.

Kill Chain Phase

• Collection (TA0009)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Archive via Utility technique is applicable to target environment
• Check Linux systems for indicators of Archive via Utility
• Check macOS systems for indicators of Archive via Utility
• Check Windows systems for indicators of Archive via Utility
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Compress Data for Exfiltration With Rar

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory

Supported Platforms: windows

"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}

Dependencies:

• Rar tool must be installed at specified location (#{rar_exe})

Atomic Test 2: Compress Data and lock with password for Exfiltration with winrar

Note: Requires winrar installation rar a -p"blue" hello.rar (VARIANT)

Supported Platforms: windows

mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{rar_exe}" a -hp"blue" hello.rar
dir

Dependencies:

• Rar tool must be installed at specified location (#{rar_exe})

Atomic Test 3: Compress Data and lock with password for Exfiltration with winzip

Note: Requires winzip installation wzzip sample.zip -s"blueblue" *.txt (VARIANT)

Supported Platforms: windows

path=%path%;"C:\Program Files (x86)\winzip"
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{winzip_exe}" -min -a -s"hello" archive.zip *
dir

Dependencies:

• Winzip must be installed

Atomic Test 4: Compress Data and lock with password for Exfiltration with 7zip

Note: This test requires 7zip installation

Supported Platforms: windows

mkdir $PathToAtomicsFolder\T1560.001\victim-files
cd $PathToAtomicsFolder\T1560.001\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{7zip_exe}" u archive.7z *txt -pblue
dir

Dependencies:

• 7zip tool must be installed at specified location (#{7zip_exe})

Atomic Test 5: Data Compressed - nix - zip

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.

Supported Platforms: linux, macos Elevation Required: Yes

zip #{output_file} #{input_files}

Dependencies:

• Files to zip must exist (#{input_files})

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Archive via Utility by examining the target platforms (Linux, macOS, Windows).

2. Assess Existing Defenses: Review whether mitigations for T1560.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1047 Audit

System scans can be performed to identify unauthorized archival utilities.

Detection

Detect Archiving via Utility (T1560.001)

Risk Assessment

CWE Categories

References

• WinRAR Homepage
• WinZip Homepage
• 7zip Homepage
• diantz.exe_lolbas
• Wikipedia File Header Signatures
• Atomic Red Team - T1560.001
• MITRE ATT&CK - T1560.001