sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Cadelspy has the ability to compress stolen data into a .cab file.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Chrommme can encrypt and store on disk collected data before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Daserf hides collected data in password-protected .rar archives.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Dtrack packs collected data into a password protected archive.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Emotet has been observed encrypting the data it collects before sending it to the C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Empire can ZIP directories on the target system.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Exaramel for Windows automatically encrypts files before sending them to the C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Gold Dragon encrypts data using Base64 before being sent to the command and control server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
KONNI has encrypted data and files prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Kessel can RC4-encrypt credentials before sending to the C2.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
LightNeuron contains a function to encrypt and store emails that it collects.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Lizar has encrypted data before sending it to the server.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
LoFiSe can collect files into password-protected ZIP-archives for exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Lurid can compress data before sending it.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Machete stores zipped files with profile data from installed web browsers.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
NETWIRE has the ability to compress archived screenshots.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
PowerLess can encrypt browser database files prior to exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Proton zips up files before exfiltrating them.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Remexi encrypts and adds all gathered browser data into files for upload to C2.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
RunningRAT contains code to compress files.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
TAINTEDSCRIBE has used `FileReadZipSend` to compress a file and send to C2.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
VERMIN encrypts the collected files using 3-DES.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
WellMail can archive files on the compromised host.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
XCSSET will compress entire `~/Desktop` folders excluding all `.git` folders, but only if the total data size is under 200MB.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.
Technique: T1560 Archive Collected Data, Tactic: TA0009 Collection
During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During Cutting Edge, threat actors saved collected data to a tar archive.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT1 has used RAR to compress files before moving them outside of the victim network.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT3 has used tools to compress data before exfilling it.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT33 has used WinRAR to compress data prior to exfil.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT39 has used WinRAR and 7-Zip to compress an archive stolen data.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT41 created a RAR archive of targeted files for exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
APT5 has used the JAR/ZIP file format for exfiltrated files.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Akira uses utilities such as WinRAR to archive data prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
FIN13 has compressed the dump output of compromised credentials with a 7zip binary.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
FIN8 has used RAR to compress collected data before exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Fox Kitten has used 7-Zip to archive data.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Gallmaker has used WinZip, likely to archive data prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Kimsuky has used QuickZip to archive stolen files before exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Sowbug extracted documents and bundled them into a RAR archive.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
ToddyCat has leveraged  xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Wizard Spider has archived data into ZIP files on compromised machines.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
menuPass has compressed files before exfiltration using TAR and RAR.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
AppleSeed can zip and encrypt data collected on a target system.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Calisto uses the `zip -r` command to compress the data collected on the local system.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Crutch has used the WinRAR utility to compress and encrypt stolen files.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Daserf hides collected data in password-protected .rar archives.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
DustySky can compress files via RAR while staging data to be exfiltrated.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
IceApple can encrypt and compress files using Gzip prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Micropsia creates a RAR archive based on collected files on the victim's machine.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Octopus has compressed data before exfiltrating it using a tool called Abbrevia.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Okrum was seen using a RAR archiver tool to compress/decompress data.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
OopsIE compresses collected files with GZipStream before sending them to its C2 server.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
PoetRAT has the ability to compress files with zip.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
PoshC2 contains a module for compressing data using ZIP.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Pupy can compress data with Zip before sending it over C2.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Ramsay can compress and archive collected files using WinRAR.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Rclone can compress files using `gzip` prior to exfiltration.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Turian can use WinRAR to create a password-protected archive for files of interest.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
WindTail has the ability to use the macOS built-in zip utility to archive files.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
certutil may be used to Base64 encode collected data.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
iKitten will zip up the /Library/Keychains directory before exfiltrating it.
Technique: T1560.001 Archive Collected Data: Archive via Utility, Tactic: TA0009 Collection
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
BADFLICK has compressed data using the aPLib compression library.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
Cardinal RAT applies compression to C2 traffic using the ZLIB library.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
Denis compressed collected data using zlib.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
Epic compresses the collected data with bzip2 before sending it to the C2 server.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
FunnyDream has compressed collected files with zLib.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
InvisiMole can use zlib to compress and decompress data.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
SeaDuke compressed data with zlib prior to sending it over C2.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
The ZLib backdoor compresses communications using the standard Zlib compression library.
Technique: T1560.002 Archive Collected Data: Archive via Library, Tactic: TA0009 Collection
During C0017, APT41 hex-encoded PII data prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
CopyKittens encrypts data with a substitute cipher prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Kimsuky has used RC4 encryption before exfil.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Mustang Panda has encrypted documents with RC4 prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Agent.btz saves system information into an XML file that is then XOR-encoded.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
BLUELIGHT has encoded data into a binary blob using XOR.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
FrameworkPOS can XOR credit card information before exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
HAWKBALL has encrypted data with XOR before sending it over the C2 channel.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Machete's collected data is encrypted with AES before exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
NETWIRE has used a custom encryption algorithm to encrypt collected data.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
OSX_OCEANLOTUS.D has used AES in CBC mode to encrypt collected data when saving that data to disk.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Okrum has used a custom implementation of AES encryption to encrypt collected data.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
RGDoor encrypts files with XOR before sending them back to the C2 server.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
RawPOS encodes credit card data it collected from the victim with XOR.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Reaver encrypts collected data with an incremental XOR key prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
SombRAT has encrypted collected data with AES-256 using a hardcoded key.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Squirrelwaffle has encrypted collected data using a XOR-based algorithm.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
T9000 encrypts collected data using a single byte XOR key.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
metaMain has used XOR-based encryption for collected files before exfiltration.
Technique: T1560.003 Archive Collected Data: Archive via Custom Method, Tactic: TA0009 Collection
Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
AcidRain iterates over device file identifiers on the target, opens the device file, and either overwrites the file or calls various IOCTLS commands to erase it.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
BlackCat has the ability to wipe VM snapshots on compromised networks.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
MegaCortex can wipe deleted data from all drives using `cipher.exe`.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
StoneDrill can wipe the accessible physical or logical drives of the infected machine.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.
Technique: T1561.001 Disk Wipe: Disk Content Wipe, Tactic: TA0040 Impact
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
KillDisk overwrites the first sector of the Master Boot Record with “0x00”.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
Shamoon has been seen overwriting features of disk structure such as the MBR.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
StoneDrill can wipe the master boot record of an infected computer.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.
Technique: T1561.002 Disk Wipe: Disk Structure Wipe, Tactic: TA0040 Impact
Magic Hound has disabled LSA protection on compromised hosts using `"reg" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f`.
Technique: T1562 Impair Defenses, Tactic: TA0005 Defense Evasion
Stuxnet reduces the integrity level of objects to allow write actions.
Technique: T1562 Impair Defenses, Tactic: TA0005 Defense Evasion
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry internet settings to lower internet security.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Ember Bear has executed a batch script designed to disable Windows Defender on a compromised host.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
FIN6 has deployed a utility script named `kill.bat` to disable anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the `taskkill` command.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
MuddyWater can disable the system's local proxy settings.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Rocke used scripts which detected and uninstalled antivirus software.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
TA2541  has attempted to disable built-in security protections such as Windows AMSI.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
TA505 has used malware to disable Windows Defender.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Agent Tesla has the capability to kill any running analysis processes and AV software.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Avaddon looks for and attempts to stop anti-malware solutions.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Babuk can stop anti-virus services on a compromised host.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Brave Prince terminates antimalware processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the `pkill cfprefsd` command to prevent users from inspecting processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
ChChes can alter the victim's proxy configuration.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Clop can uninstall or disable security products.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Conficker terminates various services related to system security and Windows.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
DarkComet can disable Security Center functions like anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
DarkGate will terminate processes associated with several security software products if identified during execution.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Diavol can attempt to stop security software.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
EKANS stops processes related to security and management software.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Egregor has disabled Windows Defender to evade protections.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Gold Dragon terminates anti-malware processes if they’re found running on the system.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
H1N1 kills and disables services for Windows Security Center, and Windows Defender.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
HDoor kills anti-virus found on the victim.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Hildegard has modified DNS resolvers to evade DNS monitoring tools.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Imminent Monitor has a feature to disable Windows Task Manager.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
JPIN can lower security settings by changing Registry keys.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
MegaCortex was used to kill endpoint security processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
NanoCore can modify the victim's anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Netwalker can detect and terminate active security software-related processes on infected systems.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Proton kills security tools like Wireshark that are running.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Pysa has the capability to stop antivirus services and disable Windows Defender.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
REvil can connect to and disable the Symantec server on the victim's network.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
RunningRAT kills antimalware running process.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Ryuk has stopped services related to anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Skidmap has the ability to set SELinux to permissive mode.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
SslMM identifies and kills anti-malware processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
ThiefQuest uses the function `kill_unwanted` to obtain a list of running processes and kills each process matching a list of security related processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
TinyZBot can disable Avira anti-virus.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
TrickBot can disable Windows Defender.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
ZIPLINE can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
ZxShell can kill AV products' processes.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.
Technique: T1562.001 Impair Defenses: Disable or Modify Tools, Tactic: TA0005 Defense Evasion
During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.
Technique: T1562.002 Impair Defenses: Disable Windows Event Logging, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.
Technique: T1562.002 Impair Defenses: Disable Windows Event Logging, Tactic: TA0005 Defense Evasion
Magic Hound has executed scripts to disable the event log service.
Technique: T1562.002 Impair Defenses: Disable Windows Event Logging, Tactic: TA0005 Defense Evasion
Threat Group-3390 has used appcmd.exe to disable logging on a victim server.
Technique: T1562.002 Impair Defenses: Disable Windows Event Logging, Tactic: TA0005 Defense Evasion
Wevtutil can be used to disable specific event logs on the system.
Technique: T1562.002 Impair Defenses: Disable Windows Event Logging, Tactic: TA0005 Defense Evasion
APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.
Technique: T1562.003 Impair Defenses: Impair Command History Logging, Tactic: TA0005 Defense Evasion
SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.
Technique: T1562.003 Impair Defenses: Impair Command History Logging, Tactic: TA0005 Defense Evasion
During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Carbanak may use netsh to add local firewall rule exceptions.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Kimsuky has been observed disabling the system firewall.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion
TeamTNT has disabled `iptables`.
Technique: T1562.004 Impair Defenses: Disable or Modify System Firewall, Tactic: TA0005 Defense Evasion