Archive Collected Data

What is Archive Collected Data?

“Archive Collected Data is documented as technique T1560 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Archive Collected Data activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor compression utility execution including 7z.exe, rar.exe, and zip.exe with password flags such as -p, -hp, and their equivalents, as password-protected archive creation is a strong indicator of data staging for exfiltration.

2. 2

   Alert on large archive file creation in unusual directories such as temporary folders, user desktops, recycle bins, or hidden directories, particularly when the archive is created by a process with no legitimate archiving function.

3. 3

   Correlate archive creation events with data access patterns, alerting when archive creation follows periods of mass file access across sensitive directories, indicating that collected data is being packaged for exfiltration.

4. 4

   Detect split archive creation using multi-volume flags in compression tools, as attackers sometimes split large archives into smaller chunks to evade transfer size-based detection controls or to fit within exfiltration channel limitations.

5. 5

   Monitor the size relationship between data accessed and archives created, as a rough size correlation between recently accessed files and a newly created archive provides strong evidence that the archive contains the accessed data staged for theft.

Example Alerts

These realistic alert examples show what Archive Collected Data looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Archive Collected Data?

Detection centers on XDR, SIEM telemetry for the collection phase of the attack. Monitor compression utility execution including 7z.exe, rar.exe, and zip.exe with password flags such as -p, -hp, and their equivalents, as password-protected archive creation is a strong indicator of data staging for exfiltration. Alert on large archive file creation in unusual directories such as temporary folders, user desktops, recycle bins, or hidden directories, particularly when the archive is created by a process with no legitimate archiving function.

What does a Archive Collected Data alert look like?

A representative XDR detection is "Password-Protected RAR Archive Created from Sensitive Files" (high severity): rar.exe executed with -hp (encrypt headers and content) flag creating an archive containing files sourced from Finance and HR network shares. The 8.4GB archive was created in C:\Users\Public\Temp by a process that had accessed 12,000 files from these shares over the preceding 40 minutes. Password-protected archive creation immediately after mass file access is a reliable pre-exfiltration indicator requiring immediate investigation.

Which tools detect Archive Collected Data, and how can I practice?

Archive Collected Data (T1560) is best surfaced with XDR, SIEM telemetry, which exposes the collection signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.