Data Compression and Archiving for Exfiltration

Overview

Data compression and archiving for exfiltration is a technique used by adversaries to reduce the size of collected data and consolidate multiple files into a single package for efficient unauthorized transfer. This method facilitates stealthy and expedited data theft during the exfiltration phase of an attack lifecycle, helping attackers evade detection and overcome network or storage constraints.

Attack Objective

• Primary goal: Efficient and covert data theft through size reduction and consolidation
• Attack lifecycle stage: Exfiltration
• Advances attacker position by enabling faster, less conspicuous transfer of valuable information out of the target environment

How the Technique Works

Adversaries use compression and archiving tools to bundle and shrink data before exfiltration. This process typically involves selecting targeted files or directories, applying compression algorithms to reduce file size, and packaging the data into archive formats. The resulting archive is then transmitted over command and control channels, removable media, or other exfiltration vectors, minimizing the volume of data transferred and reducing the likelihood of triggering data loss prevention or anomaly detection systems.

Common Methods & Variations

• Use of standard compression utilities (e.g., ZIP, RAR, 7z) or native OS archiving tools
• On-premises environments often see use of built-in command-line tools; cloud environments may involve compression within cloud storage or compute instances
• Living-off-the-land techniques leveraging existing system utilities versus custom or embedded compression routines within malware

Indicators of Compromise (IOCs)

• Unusual creation or modification of archive files in sensitive directories
• Execution of compression utilities or commands outside normal user behavior
• Network traffic patterns consistent with transfer of compressed archives, including anomalous outbound connections or data flows
• Logs showing file access spikes or mass file reads preceding archive creation

Detection Strategies

• Monitoring endpoint process execution and command-line arguments for compression tool usage
• Network traffic analysis for large or irregular outbound data transfers, especially of archive file types
• Behavioral detection focusing on unusual file access patterns and timing correlated with archive creation
• Correlation of file system events with network exfiltration attempts to identify suspicious activity chains

Mitigation & Prevention

• Implement strict data access controls and least privilege principles to limit data availability for compression
• Deploy data loss prevention (DLP) solutions capable of inspecting compressed archives and blocking unauthorized transfers
• Restrict or monitor use of native compression utilities through application control or endpoint detection and response (EDR) policies
• Enforce network segmentation and egress filtering to limit exfiltration paths

Response Considerations

• Immediately isolate affected systems to prevent further data exfiltration
• Analyze file system and process logs to identify scope and timeline of archive creation and transfer
• Examine network logs for exfiltration destinations and data volumes
• Strengthen controls on data access and monitor for reoccurrence post-incident

Related Techniques

• Data Staged: Preparation of data prior to compression and exfiltration
• Exfiltration Over Command and Control Channel: Transmission of compressed archives via established channels
• Obfuscated Files or Information: Use of compression as a form of data obfuscation

Mapping & References

• MITRE ATT&CK Tactic: Exfiltration
• MITRE ATT&CK Technique: Data Compressed (T1560)
• Public resources: Security vendor whitepapers on data exfiltration detection, incident reports highlighting compression use in breaches