MITRE ATT&CK technique · Collection

`T1560.003` Archive via Custom Method

Sub-technique of T1560 Archive Collected Data

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.