Archive Collected Data: Archive via Custom Method T1560.003
Tactic: Collection
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.
Events covered
2 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | unlink | File Unlink |
| ESF | write | File Write |
Authoring guide
These 1 rule share fields, values, and exclusions.
Fields filtered most (3 distinct)
These fields appear most often in rule filters.
Top indicator values (6 distinct)
These values appear most often in rule predicates.
Exclusions (2 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: macOS
Domain: Endpoint