BIOC
Informational
✕
Encrypted zip archive creation
Attackers may stage information for exfiltration by encrypting it beforehand in a zip archive.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
Indicator:
Process action type = execution AND target process cmd = * -p* , * -e* , * --password* , * --encrypt* AND target process name = zip Host host os = macos , linux
Preventable: yes