attack.t1560

Compressed File Creation Via Tar.EXE

Aug 12, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Aug 12, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Conti NTDS Exfiltration Command

Aug 12, 2024 · attack.collection attack.t1560 detection.emerging-threats ·

Share on:

Detects a command used by conti to exfiltrate NTDS