Compress Data and Lock With Password for Exfiltration With WINZIP
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Detection logic
Detection requirements
- Platform
- LinuxmacOSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- windows
- Log source category
- process_creation
Known benign triggers
- Unknown
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md | 6 |
From the source
- At source
- Open at source
- Upstream identifier
- e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
- Tagged by the source as
- attack.collection
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1