T1560 · Archive Collected Data

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1560 · Archive Collected Data · Sunturai

attack-patternenterprise-attackT1560

Archive Collected Data

attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Created: Feb 20, 2020, 8:53 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

27 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Theom - Shadow DB with atypical accesses	High	Microsoft Sentinel analytics	Oct 6, 2026	MIT License
Theom - Shadow DB large datastore value	High	Microsoft Sentinel analytics	Oct 6, 2026	MIT License
Theom - Overprovisioned Roles Shadow DB	High	Microsoft Sentinel analytics	Oct 6, 2026	MIT License
GenAI Process Performing Encoding/Chunking Prior to Network Activity	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Encrypting Files with WinRar or 7z	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive File Access followed by Compression	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Files Compression Inside A Container	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Files Compression	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive File Compression Detected via Defend for Containers	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Theom Medium Risks	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom Low Risks	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom Insights	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom High Risks	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom Critical Risks	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom - Least priv large value shadow DB	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Theom - Dark Data with large fin value	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Judgement Panda Exfil Activity	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Corelight - File uploads by source	Low	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Corelight - Files in logs	Low	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Corelight - Top sources of data transferred	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Corelight - Compressed Files Transferred over HTTP	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Powershell Empire Cmdlets Executed in Command Line	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Windows Archived Collected Data In TEMP Folder	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Archive Collected Data via Powershell	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Detect Certipy File Modifications	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 25 of 27

Filter in the catalogue

External references

mitre-attackT1560Open reference

DOJ GRU Indictment Jul 2018Open reference

Wikipedia File Header SignaturesOpen reference

Platforms

LinuxmacOSWindows

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object