attack.t1560.001

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Aug 12, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Data Compressed

Aug 12, 2024 · attack.exfiltration attack.t1560.001 ·

Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Disk Image Mounting Via Hdiutil - MacOS

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.t1560.001 ·

Share on:

Detects the execution of the hdiutil utility in order to mount disk images.

Files Added To An Archive Using Rar.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Rar Usage with Password and Compression Level

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

Suspicious Manipulation Of Default Accounts Via Net.EXE

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Winrar Compressing Dump Files

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Winrar Execution in Non-Standard Folder

Aug 12, 2024 · attack.collection attack.t1560.001 ·

Share on:

Detects a suspicious winrar execution in a folder which is not the default installation folder

Potential Exfiltration of Compressed Files

Apr 21, 2023 · attack.exfiltration attack.t1560.001 attack.t1005 ·

Share on:

This rule detects potential exfiltration by looking for a few compression extensions in the uri and signs of compression in the mime type, file type, and http body