Data Compressed

Title: Data Compressed
Status: test
Description:An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
modified:2023-07-28
Tags:

• -'attack.exfiltration'
• -'attack.collection'
• -'attack.t1560.001'

Logsource:

• product: linux
• service: auditd

Detection:
  selection1:
    type: 'execve'
    a0: 'zip'
  selection2:
    type: 'execve'
    a0: 'gzip'
    a1: '-k'
  selection3:
    type: 'execve'
    a0: 'tar'
    a1|contains: '-c'
  condition:1 of selection*
Falsepositives:
  -Legitimate use of archiving tools by legitimate user.
Level: low