# T1560.001 - Archive Collected Data: Archive via Utility

## Description from ATT&CK

> Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
> 
> Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems.
> 
> On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration.
> 
> Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)

[Source](https://attack.mitre.org/techniques/T1560/001)

## Atomic Tests

- [Atomic Test #1: Compress Data for Exfiltration With Rar](#atomic-test-1-compress-data-for-exfiltration-with-rar)
- [Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar](#atomic-test-2-compress-data-and-lock-with-password-for-exfiltration-with-winrar)
- [Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip](#atomic-test-3-compress-data-and-lock-with-password-for-exfiltration-with-winzip)
- [Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip](#atomic-test-4-compress-data-and-lock-with-password-for-exfiltration-with-7zip)
- [Atomic Test #5: Data Compressed - nix - zip](#atomic-test-5-data-compressed---nix---zip)
- [Atomic Test #6: Data Compressed - nix - gzip Single File](#atomic-test-6-data-compressed---nix---gzip-single-file)
- [Atomic Test #7: Data Compressed - nix - tar Folder or File](#atomic-test-7-data-compressed---nix---tar-folder-or-file)
- [Atomic Test #8: Data Encrypted with zip and gpg symmetric](#atomic-test-8-data-encrypted-with-zip-and-gpg-symmetric)
- [Atomic Test #9: Encrypts collected data with AES-256 and Base64](#atomic-test-9-encrypts-collected-data-with-aes-256-and-base64)
- [Atomic Test #10: ESXi - Remove Syslog remote IP](#atomic-test-10-esxi---remove-syslog-remote-ip)
- [Atomic Test #11: Compress a File for Exfiltration using Makecab](#atomic-test-11-compress-a-file-for-exfiltration-using-makecab)
- [Atomic Test #12: Copy and Compress AppData Folder](#atomic-test-12-copy-and-compress-appdata-folder)

### Atomic Test #1: Compress Data for Exfiltration With Rar

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory

**Supported Platforms:** Windows

**auto_generated_guid:** `02ea31cb-3b4c-4a2d-9bf1-e4e70ebcf5d0`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_path | Path that should be compressed into our output file | path | %USERPROFILE%|
| file_extension | Extension of files to compress | string | .txt|
| output_file | Path where resulting compressed data should be placed | path | %USERPROFILE%&#92;T1560.001-data.rar|
| rar_installer | Winrar installer | path | %TEMP%&#92;winrar.exe|
| rar_exe | The RAR executable from Winrar | path | %programfiles%/WinRAR/Rar.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}
```

#### Cleanup Commands

```cmd
del /f /q /s #{output_file} >nul 2>&1
```

#### Dependencies: Run with `command_prompt`!

##### Description: Rar tool must be installed at specified location (#{rar_exe})

###### Check Prereq Commands

```cmd
if not exist "#{rar_exe}" (exit /b 1)
```

###### Get Prereq Commands

```cmd
echo Downloading Winrar installer
bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
#{rar_installer} /S
```

### Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar

Note: Requires winrar installation
rar a -p"blue" hello.rar (VARIANT)

**Supported Platforms:** Windows

**auto_generated_guid:** `8dd61a55-44c6-43cc-af0c-8bdda276860c`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rar_installer | Winrar installer | path | %TEMP%&#92;winrar.exe|
| rar_exe | The RAR executable from Winrar | path | %programfiles%/WinRAR/Rar.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{rar_exe}" a -hp"blue" hello.rar
dir
```


#### Dependencies: Run with `command_prompt`!

##### Description: Rar tool must be installed at specified location (#{rar_exe})

###### Check Prereq Commands

```cmd
if not exist "#{rar_exe}" (exit /b 1)
```

###### Get Prereq Commands

```cmd
echo Downloading Winrar installer
bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
#{rar_installer} /S
```

### Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip

Note: Requires winzip installation
wzzip sample.zip -s"blueblue" *.txt (VARIANT)

**Supported Platforms:** Windows

**auto_generated_guid:** `01df0353-d531-408d-a0c5-3161bf822134`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| winzip_exe | Path to installed Winzip executable | path | %ProgramFiles%&#92;WinZip&#92;winzip64.exe|
| winzip_url | Path to download Windows Credential Editor zip file | url | https://download.winzip.com/gl/nkln/winzip24-home.exe|
| winzip_hash | File hash of the Windows Credential Editor zip file | string | B59DB592B924E963C21DA8709417AC0504F6158CFCB12FE5536F4A0E0D57D7FB|

#### Attack Commands: Run with `command_prompt`!

```cmd
path=%path%;"C:\Program Files (x86)\winzip"
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{winzip_exe}" -min -a -s"hello" archive.zip *
dir
```


#### Dependencies: Run with `powershell`!

##### Description: Winzip must be installed

###### Check Prereq Commands

```powershell
cmd /c 'if not exist "#{winzip_exe}" (echo 1) else (echo 0)'
```

###### Get Prereq Commands

```powershell
IEX(IWR "https://raw.github