Archive via Utility
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <cod...
BY SOURCE
PROCEDURES (12)
Auto-extracted: 4 detections for encrypt
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for process creation monitoring
Auto-extracted: 3 detections for exfiltrat
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for dump
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for credential