Archive Collected Data: Archive via Custom Method
- ID
- T1560.003
- Tactics
- TA0009 Collection
- Sub-technique of
- T1560 Archive Collected Data
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Creation, File Creation, Process Access, Command Execution, Process Modification
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.[1]
Detection
- DET0438 Detect Archiving via Custom Method (T1560.003)
Data components: Process Creation, File Creation, Process Access, Command Execution, Process Modification
Groups (7)
- G0030 Lotus Blossom
- G0032 Lazarus Group
- G0037 FIN6
- G0052 CopyKittens
- G0094 Kimsuky
- G0129 Mustang Panda
- G1048 UNC3886
Software (31)
- S0035 SPACESHIP
- S0036 FLASHFLOOD
- S0038 Duqu
- S0045 ADVSTORESHELL
- S0072 OwaAuth
- S0092 Agent.btz
- S0098 T9000
- S0169 RawPOS
- S0172 Reaver
- S0198 NETWIRE
- S0258 RGDoor
- S0260 InvisiMole
- S0264 OopsIE
- S0352 OSX_OCEANLOTUS.D
- S0391 HAWKBALL
- S0409 Machete
- S0438 Attor
- S0439 Okrum
- S0443 MESSAGETAP
- S0448 Rising Sun
- S0458 Ramsay
- S0491 StrongPity
- S0503 FrameworkPOS
- S0603 Stuxnet
- S0615 SombRAT
- S0657 BLUELIGHT
- S0661 FoggyWeb
- S1030 Squirrelwaffle
- S1042 SUGARDUMP
- S1044 FunnyDream
- S1059 metaMain