cyberstrikeus T1560.002 Archive via Library
Sub-technique of: T1560
High-Level Description
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data.
Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Kill Chain Phase
- Collection (TA0009)
Platforms: Linux, macOS, Windows
What to Check
- Identify if Archive via Library technique is applicable to target environment
- Check Linux systems for indicators of Archive via Library
- Check macOS systems for indicators of Archive via Library
- Check Windows systems for indicators of Archive via Library
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Compressing data using GZip in Python (FreeBSD/Linux)
Uses GZip from Python to compress files
Supported Platforms: linux
which_python=`which python || which python3`
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"
Dependencies:
- Requires Python
Atomic Test 2: Compressing data using bz2 in Python (FreeBSD/Linux)
Uses bz2 from Python to compress files
Supported Platforms: linux
which_python=`which python || which python3`
$which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(str(bz2content));output_file.close();"
Dependencies:
- Requires Python
Atomic Test 3: Compressing data using zipfile in Python (FreeBSD/Linux)
Uses zipfile from Python to compress files
Supported Platforms: linux
which_python=`which python || which python3`
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"
Dependencies:
- Requires Python
Atomic Test 4: Compressing data using tarfile in Python (FreeBSD/Linux)
Uses tarfile from Python to compress files
Supported Platforms: linux
which_python=`which python || which python3`
$which_python -c "import tarfile; output_file = tarfile.open('#{path_to_output_file}','w'); output_file.add('#{path_to_input_file}'); output_file.close()"
Dependencies:
- Requires Python
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Archive via Library by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1560.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detect Archiving via Library (T1560.002)
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Archive via Library technique applicable | Low | Collection |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |