Archive Collected Data detection rulesT1560

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

windows · process_creation

Detects a command used by conti to exfiltrate NTDS

windows · process_creation

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · process_creation

Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

windows · process_creation

Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

windows · process_creation

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

windows · process_creation

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows · process_creation

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

windows · process_creation

Detects the execution of the hdiutil utility in order to mount disk images.

macos · process_creation

Detects potentially suspicious command line arguments of common data compression tools

windows · process_creation

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

windows · process_creation

Detects a suspicious WinRAR execution in a folder which is not the default installation folder

windows · process_creation

Various protocols maybe used to put data on the device for exfil or infil

cisco

Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows · ps_script

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

windows · process_creation

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

windows · process_creation

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

linux

Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

windows · process_creation

Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

windows · process_creation