T1560 — Archive Collected Data

# T1560 - Archive Collected Data

## SOC Recommendation
Investigate Archive Collected Data activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let ArchiveTools = dynamic([
    "7z.exe",
    "7za.exe",
    "winrar.exe",
    "rar.exe",
    "tar.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(1d)
| where FileName in~ (ArchiveTools)
| where ProcessCommandLine has_any ("-p", "/p", "a -", "-hp")
| project
    TimeGenerated,
    DeviceName,
    DeviceId,
    AccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    FolderPath
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
TheomAlerts_CL
  | where customProps_RuleId_s == "TRIS0032" and (priority_s == "P1" or priority_s == "P2")
```
```kql
TheomAlerts_CL
  | where customProps_RuleId_s == "TRIS0032" and (priority_s == "P1" or priority_s == "P2")
```

## Escalation Criteria
- Archive Collected Data activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1560.json
• /api/recommendations/T1560.json
• /api/d3fend/T1560.json
• /api/mappings/T1560.json
• /api/confluence/T1560.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1560.json

Response:

{
  "technique_id": "T1560",
  "name": "Archive Collected Data",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.",
  "soc_recommendation": "Investigate Archive Collected Data activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed archive collected data activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Archive Utility Staging Files Before Exfiltration\" -- Flags command-line archive utilities used to compress data with a password, often a precursor to staged exfiltration."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CO-004 — Archive Utility Staging Files Before Exfiltration",
        "description": "Flags command-line archive utilities used to compress data with a password, often a precursor to staged exfiltration. (Source: Bell Integration baseline detection library, mapped via sub-technique T1560.001.)",
        "query": "let ArchiveTools = dynamic([\n    \"7z.exe\",\n    \"7za.exe\",\n    \"winrar.exe\",\n    \"rar.exe\",\n    \"tar.exe\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(1d)\n| where FileName in~ (ArchiveTools)\n| where ProcessCommandLine has_any (\"-p\", \"/p\", \"a -\", \"-hp\")\n| project\n    TimeGenerated,\n    DeviceName,\n    DeviceId,\n    AccountName,\n    FileName,\n    ProcessCommandLine,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    FolderPath\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "545fdcc7-2123-4b8a-baf6-409f29aad4b1 — Theom - Dark Data with large fin value",
        "description": "\"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed data with a large financial value, but that has not been accessed recently. Use this information to enforce data retention policies)\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "TheomAlerts_CL\n  | where customProps_RuleId_s == \"TRIS0032\" and (priority_s == \"P1\" or priority_s == \"P2\")"
      },
      {
        "name": "67b9ff50-5393-49d5-b66f-05b33e2f35d2 — Theom - Least priv large value shadow DB",
        "description": "\"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed shadow (or clone) databases/tables that have a large financial value. Additionally, it has observed roles that are overprovisioned for these data stores. As per this requirement, use this information to apply data access control lists or access permissions and enforce data retention policies)\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "TheomAlerts_CL\n  | where customProps_RuleId_s == \"TRIS0032\" and (priority_s == \"P1\" or priority_s == \"P2\")"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "d9faf1ba-a216-4c29-b8e0-a05a9d14b027 — Sensitive Files Compression Inside A Container",
        "description": "(EQL) Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\nprocess.entry_leader.entry_meta.type == \"container\" and process.name in (\"zip\", \"tar\", \"gzip\", \"hdiutil\", \"7z\") and\nprocess.command_line like~ (\n  \"*/root/.ssh/*\", \"*/home/*/.ssh/*\", \"*/root/.bash_history*\", \"*/etc/hosts*\", \"*/root/.aws/*\", \"*/home/*/.aws/*\",\n  \"*/root/.docker/*\", \"*/home/*/.docker/*\", \"*/etc/group*\", \"*/etc/passwd*\", \"*/etc/shadow*\", \"*/etc/gshadow*\"\n)"
      },
      {
        "name": "a0fbd7a9-1923-4e05-92df-b484168f17bc — Sensitive File Access followed by Compression",
        "description": "(EQL) Detects when a sensitive file is accessed followed by the immediate creation of a compressed file in a suspicious location. This activity can indicate an attempt to collect sensitive local data and stage it for exfiltration. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by process.entity_id with maxspan=30s\n  [file where host.os.type == \"macos\" and event.action == \"open\" and \n    not file.name in~ (\"System.keychain\", \"login.keychain-db\", \"preferences.plist\", \"com.apple.TimeMachine.plist\")]\n  [file where host.os.type == \"macos\" and event.action == \"modification\" and \n    file.extension in (\"zip\", \"gzip\", \"gz\") and\n    file.path like~ (\"/Users/Shared/*\", \"/Library/WebServer/*\", \"/Users/*/Library/WebServer/*\",\n                     \"/Library/Graphics/*\", \"/Users/*/Library/Graphics/*\", \"/Library/Fonts/*\",\n                     \"/Users/*/Library/Fonts/*\", \"/private/var/root/Library/HTTPStorages/*\",\n                     \"/tmp/*\", \"/var/tmp/*\", \"/private/tmp/*\") and\n    not file.path like~ (\"/Library/Logs/CrashReporter/*\", \"/private/tmp/publish.*\")]"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Archive Collected Data activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1560 - Archive Collected Data Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}