Analytics
Low
✕
User collected remote shared files in an archive
Multiple files from remote shares were archived in a local file. This may indicate collection of data and staging before exfiltration.
- Module:
- Identity Threat Detection (ITDR)
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001) Data Staged (T1074)
Attacker's goals:
Collect data and stage it on an endpoint in the organization.
Investigative actions:
Check whether the process that created the archive creates network connections as well. Check whether other users in the organization used the same process for remote archive file activity.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day