T1560 Archive Collected Data

Technique

T1560

Tactics

Collection

Research, 90 days

3

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

12

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1560

MITRE description

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine
• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-06 Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery

Detection coverage

SigmaHQ community rules

• Conti NTDS Exfiltration Command (emerging-threats)
• Compress-Archive Cmdlet Execution (threat-hunting)
• Compressed File Creation Via Tar.EXE (core)
• Compressed File Extraction Via Tar.EXE (core)

Elastic and Splunk rules

• GenAI Process Performing Encoding/Chunking Prior to Network Activity (elastic)
• Sensitive File Compression Detected via Defend for Containers (elastic)
• Sensitive Files Compression (elastic)
• Sensitive Files Compression Inside A Container (elastic)
• Sensitive File Access followed by Compression (elastic)
• Encrypting Files with WinRar or 7z (elastic)
• Compression DLL Loaded by Unusual Process (elastic)
• File Compressed or Archived into Common Format by Unsigned Process (elastic)
• PowerShell Script with Archive Compression Capabilities (elastic)
• Detect Certipy File Modifications (splunk)
• Windows Archive Collected Data via Powershell (splunk)
• Windows Archived Collected Data In TEMP Folder (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.