TA0009 · COLLECTION
Archive via Utility
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Detect it with
Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities.
Why it matters on shift
Archive via Utility is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
Kill-chain context