T1560.003 Archive via Custom Method
sub-techniqueEnterpriseAn adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.
01
platforms
Platforms this applies to.
LinuxmacOSWindows
02
tactics
ATT&CK tactics this technique serves.
03
sub-technique of
The broader entity this sits under.
04
detected by (5)
Data components that detect this.
05
countered by (D3FEND)
D3FEND countermeasures that counter this.
Isolate
Deceive
Restore
06
groups (7)
Threat groups associated with this.
07
software (31)
Malware and tools associated with this.
08
campaigns (1)
Campaigns that use this.
09
source
Where this definition is published.