T1560.003: Archive via Custom Method

collection

Summary

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)

Source Attribution

Source: MITRE ATT&CK · Confidence: high

Platforms

  • Linux
  • macOS
  • Windows

Tactic

collection

References