T1560.003: Archive via Custom Method

MITRE ATT&CK® Enterprise technique

Description

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)

Detection

(no detection guidance published)

Data sources

• (none listed)

References

• ATT&CK page: https://attack.mitre.org/techniques/T1560/003
• ATT&CK Enterprise matrix: https://attack.mitre.org/matrices/enterprise/