Analytics BIOC
Informational
✕
An unusual archive file creation by a user
An archive file was created by a user who doesn't usually create such files. This might indicate an attempt to stage data before exfiltration.
- Module:
- Identity Threat Detection (ITDR)
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001) Data Staged (T1074)
Attacker's goals:
Stage data on an endpoint in the organization.
Investigative actions:
Check for any other suspicious activity related to the host and the user involved in the alert.
- Test period:
- N/A (single event)
- Deduplication:
- 3 Days
1 variation:
- A user created an archive file for the first time Informational