What MITRE ATT&CK T1560.001: Archive via Utility (Enterprise Tactic TA0009 - Collection) requires
MITRE ATT&CK T1560.001 (Archive via Utility) is an Enterprise Collection sub-technique of T1560 (Archive Collected Data). Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1047 Audit. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls CM-02, RA-05, SC-07, SI-03, SI-04.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1560/001/
SHA-256 integrity: 860c62ce64868c257f779fe62eb082af32966517100f4c57d96f80b5025b0aba
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1560.001: Archive via Utility (https://attack.mitre.org/techniques/T1560/001/)
- MITRE ATT&CK Tactic TA0009: Collection (https://attack.mitre.org/tactics/TA0009/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1560-001-archive-via-utility.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1560-001-archive-via-utility.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1560-001-archive-via-utility
- Back to registry: Browse all 10,085 compliance nodes