Archive Collected Data: Archive via Custom Method (T1560.003)

Tactic: Collection · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 7 threat groups, 31 software entries, 1 campaign to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Archive Collected Data (T1560).

Overview

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.

Explore

• Open T1560.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1560.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan