Detect Archive via Library in CrowdStrike LogScale
Adversaries may compress or encrypt collected data prior to exfiltration using third-party or built-in programming libraries rather than standalone archival utilities. Libraries such as Python's zlib, bzip2, gzip, zipfile, and rarfile modules; .NET's System.IO.Compression (GZipStream, DeflateStream, ZipArchive); C libraries libzip and zlib; and platform-native libraries enable adversaries to compress and encrypt data programmatically within a running process. Because no separate archival utility process (7-Zip, WinRAR, tar) is spawned, this technique evades detections focused on command-line archivers. Malware families including TajMahal, LunarWeb, SeaDuke, BBSRAT, InvisiMole, and Denis have all used library-based compression to stage and exfiltrate collected data.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1560 Archive Collected Data
- Sub-technique
- T1560.002 Archive via Library
- Canonical reference
- https://attack.mitre.org/techniques/T1560/002/
LogScale Detection Query
#event_simpleName in (ProcessRollup2, ImageLoad, FileWritten, PeFileWritten)
| case {
#event_simpleName = ImageLoad
AND ImageFileName = /(?i)(zlib\.dll|zlib1\.dll|zlibwapi\.dll|bzip2\.dll|libbzip2\.dll|libzip\.dll|minizip\.dll)$/
AND NOT ImageFileName = /(?i)(system32|syswow64|7-zip|winrar)/
AND NOT FileName = /(?i)(7z\.exe|7zg\.exe|winrar\.exe|msiexec\.exe)$/
| DetectionSource := "CompressionDllLoad" ;
#event_simpleName = ProcessRollup2
AND FileName = /(?i)(powershell\.exe|pwsh\.exe)$/
AND CommandLine = /(?i)(IO\.Compression|GZipStream|DeflateStream|ZipArchive|ZipFile|ICSharpCode|DotNetZip)/
| DetectionSource := "PowerShellLibraryCompression" ;
#event_simpleName = ProcessRollup2
AND FileName = /(?i)python[0-9]*\.exe$/
AND CommandLine = /(?i)(import zlib|import bz2|import gzip|import zipfile|import rarfile|zlib\.compress|bz2\.compress|import lzma|import tarfile)/
| DetectionSource := "PythonLibraryCompression" ;
#event_simpleName in (FileWritten, PeFileWritten)
AND TargetFileName = /(?i)\.(gz|bz2|zlib|lzma|xz|lz)$/
AND TargetFileName = /(?i)(temp|appdata|programdata|users.public)/i
AND FileName = /(?i)(python[0-9]*\.exe|ruby\.exe|perl\.exe|node\.exe|java\.exe|javaw\.exe|wscript\.exe|cscript\.exe|mshta\.exe)$/
| DetectionSource := "StagedCompressedFileCreation" ;
* | drop()
}
| table([timestamp, ComputerName, UserName, DetectionSource, FileName, CommandLine, ImageFileName, TargetFileName, ParentBaseFileName])
| sort(timestamp, order=desc)CrowdStrike LogScale (CQL) detection for T1560.002 using native Falcon sensor telemetry without requiring Sysmon. Uses case pipeline to classify ImageLoad events for compression library loading outside trusted paths, ProcessRollup2 events for PowerShell .NET compression API usage and Python compression module imports in captured command lines, and FileWritten/PeFileWritten events for scripting interpreter creation of compressed archives in staging directories. Regex matching with /pattern/ syntax per LogScale CQL.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Python automation agents or data pipeline workers managed by IT/DevOps that import compression modules with imports visible in Falcon-captured CommandLine telemetry during script execution
- Security forensics or IR tooling written in PowerShell that uses System.IO.Compression to compress memory dumps, log collections, or triage packages for analyst review and transfer
- Packaged Electron-based or Python-based desktop applications that ship bundled zlib.dll or libbzip2.dll in application directories outside Program Files, triggering ImageLoad events during normal startup
Other platforms for T1560.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Python zlib Compression of Sensitive File Collection
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'import zlib' and 'zlib.compress'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.zlib. DeviceFileEvents: FileCreated action for the .zlib output file. DeviceFileEvents: FileRead action for the hosts file.
- Test 2PowerShell GZipStream Compression via System.IO.Compression
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'IO.Compression', 'GZipStream', 'MemoryStream', and 'CompressionMode'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.gz. PowerShell ScriptBlock Log Event ID 4104 with full .NET compression code.
- Test 3Python bzip2 Multi-File Collection and Compression
Expected signal: Syslog/auditd: python3 process execution with command line containing 'import bz2', 'tarfile', and output path in /tmp. File creation event for /tmp/stage_df00.tar.bz2. Auditd syscall events: openat for source files, write for output file. Linux process accounting: python3 with suspicious file access pattern.
- Test 4Python rarfile Library Compression (Third-Party Library)
Expected signal: Sysmon Event ID 1: python.exe with CommandLine containing 'import zipfile', 'ZIP_DEFLATED', and temp path. Sysmon Event ID 11: File Create for %TEMP%\stage_df00_lib.zip. Potential child process for pip install subprocess. DeviceFileEvents shows file read of hosts file and write of .zip artifact.
References (12)
- https://attack.mitre.org/techniques/T1560/002/
- https://github.com/madler/zlib
- https://libzip.org/
- https://pypi.org/project/rarfile/
- https://learn.microsoft.com/en-us/dotnet/api/system.io.compression
- https://securelist.com/kaspersky-lab-discovers-the-tajmahal-apt-framework/90240/
- https://www.welivesecurity.com/2024/05/23/eset-research-unveils-lunar-toolset-diplomatic-espionage/
- https://unit42.paloaltonetworks.com/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/
- https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.002/T1560.002.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1560.002 including response playbook, investigation guide, and atomic red team tests.