What MITRE ATT&CK T1560.002: Archive via Library (Enterprise Tactic TA0009 - Collection) requires
MITRE ATT&CK T1560.002 (Archive via Library) is an Enterprise Collection sub-technique of T1560 (Archive Collected Data). An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib . Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. Affected platforms: Linux, macOS, Windows. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls CM-02, RA-05, SC-07, SI-03, SI-04.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1560/002/
SHA-256 integrity: be35ffe4fe086492f76f986ea1666a93e1c193f1488d882e901936a1299bb94c
Primary Citations — 6 traced to source
- MITRE ATT&CK Technique T1560.002: Archive via Library (https://attack.mitre.org/techniques/T1560/002/)
- MITRE ATT&CK Tactic TA0009: Collection (https://attack.mitre.org/tactics/TA0009/)
+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1560-002-archive-via-library.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1560-002-archive-via-library.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1560-002-archive-via-library
- Back to registry: Browse all 10,085 compliance nodes