Detect Archive via Utility in Microsoft Sentinel
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier or more secure to transport. Adversaries may abuse utilities such as 7-Zip, WinRAR, WinZip, tar, zip, and Windows built-ins like makecab/diantz and certutil to stage data for exfiltration. Password-protected archives are a common indicator as they prevent inspection by security tools. Threat actors including HAFNIUM, APT1, APT33, Volt Typhoon, Mustang Panda, menuPass, and Wizard Spider are documented using this technique.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1560 Archive Collected Data
- Sub-technique
- T1560.001 Archive via Utility
- Canonical reference
- https://attack.mitre.org/techniques/T1560/001/
KQL Detection Query
let ArchiveTools = dynamic(["7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe", "winzip32.exe", "winzip64.exe", "zip.exe", "makecab.exe", "diantz.exe", "xcopy.exe"]);
let SuspiciousFlags = dynamic(["-p", "-hp", "a -", " a ", "-r ", "-v", "password", "-ep", "-ep2", "-ep3"]);
let SensitivePaths = dynamic(["\\ntds", "\\lsass", "\\sam", "\\system", "\\security", "\\users\\", "\\documents", "\\desktop", "\\appdata", "c:\\windows\\temp", "c:\\programdata", "\\inetpub"]);
union
(
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ArchiveTools)
| where ProcessCommandLine has_any (SuspiciousFlags) or ProcessCommandLine has_any (SensitivePaths)
| extend PasswordProtected = ProcessCommandLine has_any ("-p", "-hp", "password")
| extend TargetsSensitivePath = ProcessCommandLine has_any (SensitivePaths)
| extend MultiVolume = ProcessCommandLine has_any ("-v", "-v1", "-v2", "-v500", "-v1000")
| extend OutputToTemp = ProcessCommandLine has_any ("\\temp\\", "\\tmp\\", "\\programdata\\", "\\appdata\\")
| extend DetectionSource = "ArchiveTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
PasswordProtected, TargetsSensitivePath, MultiVolume, OutputToTemp, DetectionSource
),
(
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-encode", "-encodehex", "/encode", "/encodehex")
| extend PasswordProtected = false
| extend TargetsSensitivePath = ProcessCommandLine has_any (SensitivePaths)
| extend MultiVolume = false
| extend OutputToTemp = ProcessCommandLine has_any ("\\temp\\", "\\tmp\\", "\\programdata\\")
| extend DetectionSource = "CertutilEncode"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
PasswordProtected, TargetsSensitivePath, MultiVolume, OutputToTemp, DetectionSource
),
(
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "makecab.exe" or FileName =~ "diantz.exe"
| where ProcessCommandLine !contains "windows\\ " and ProcessCommandLine !contains "system32\\"
| extend PasswordProtected = false
| extend TargetsSensitivePath = ProcessCommandLine has_any (SensitivePaths)
| extend MultiVolume = false
| extend OutputToTemp = ProcessCommandLine has_any ("\\temp\\", "\\tmp\\", "\\programdata\\")
| extend DetectionSource = "CabinetTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
PasswordProtected, TargetsSensitivePath, MultiVolume, OutputToTemp, DetectionSource
)
| sort by Timestamp descDetects data archiving activity consistent with pre-exfiltration staging using Microsoft Defender for Endpoint DeviceProcessEvents. Covers third-party archive tools (7-Zip, WinRAR, WinZip), Windows built-ins (makecab, diantz), and certutil Base64 encoding. Flags password-protected archives, operations targeting sensitive file paths (ntds.dit, LSASS, user profile directories), multi-volume archives, and output to staging directories. Three separate query branches are unioned to cover different archival methods.
Data Sources
Required Tables
False Positives & Tuning
- System administrators using 7-Zip or WinRAR for legitimate backup or file transfer operations
- Backup software agents (Veeam, Commvault, Acronis) that invoke archive utilities as part of scheduled backup jobs
- Software packaging tools and CI/CD pipelines that compress build artifacts before deployment
- IT operations compressing log files or diagnostic data for vendor support cases
- makecab.exe invoked by Windows Update, software installers, and MSI packages as part of normal installation routines
Other platforms for T1560.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 17-Zip Password-Protected Archive of User Documents
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Program Files\7-Zip\7z.exe, CommandLine containing '-p' (password flag), input path in user Documents, output path in C:\Windows\Temp. Sysmon Event ID 11: FileCreate for C:\Windows\Temp\staged_data.zip. Security Event ID 4688 if command line auditing is enabled.
- Test 2WinRAR Multi-Volume Password-Protected Archive
Expected signal: Sysmon Event ID 1: Process Create with Image containing rar.exe, CommandLine containing '-hp' (header password), '-v50m' (multi-volume 50MB), and output path in C:\ProgramData. Sysmon Event ID 11: FileCreate events for each archive volume (svc_backup.part1.rar, svc_backup.part2.rar, etc.).
- Test 3certutil Base64 Encoding of Collected File
Expected signal: Sysmon Event ID 1 (first): Process Create for cmd.exe writing collected_data.txt. Sysmon Event ID 11: FileCreate for collected_data.txt. Sysmon Event ID 1 (second): Process Create with Image=certutil.exe, CommandLine containing '-encode', input file path, and output file path. Sysmon Event ID 11: FileCreate for encoded_output.b64.
- Test 4makecab Cabinet File Creation for Data Staging
Expected signal: Sysmon Event ID 1: Process Create with Image=makecab.exe, CommandLine containing source file path and output .cab path in C:\Windows\Temp. Sysmon Event ID 11: FileCreate events for archive_output.cab, setup.inf, and setup.rpt (makecab side-effect files). Security Event ID 4688 if command line auditing enabled.
References (12)
- https://attack.mitre.org/techniques/T1560/001/
- https://www.7-zip.org/
- https://www.rarlab.com/
- https://www.winzip.com/win/en/
- https://lolbas-project.github.io/lolbas/Binaries/Diantz/
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
- https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- https://www.secureworks.com/blog/volt-typhoon-targets-us-critical-infrastructure
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
- https://www.mandiant.com/resources/reports/apt1-exposing-one-of-chinas-cyber-espionage-units
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/makecab
Unlock Pro Content
Get the full detection package for T1560.001 including response playbook, investigation guide, and atomic red team tests.