Detect Archive via Library in Splunk
Adversaries may compress or encrypt collected data prior to exfiltration using third-party or built-in programming libraries rather than standalone archival utilities. Libraries such as Python's zlib, bzip2, gzip, zipfile, and rarfile modules; .NET's System.IO.Compression (GZipStream, DeflateStream, ZipArchive); C libraries libzip and zlib; and platform-native libraries enable adversaries to compress and encrypt data programmatically within a running process. Because no separate archival utility process (7-Zip, WinRAR, tar) is spawned, this technique evades detections focused on command-line archivers. Malware families including TajMahal, LunarWeb, SeaDuke, BBSRAT, InvisiMole, and Denis have all used library-based compression to stage and exfiltrate collected data.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1560 Archive Collected Data
- Sub-technique
- T1560.002 Archive via Library
- Canonical reference
- https://attack.mitre.org/techniques/T1560/002/
SPL Detection Query
index=wineventlog (
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
(ImageLoaded="*\\zlib.dll" OR ImageLoaded="*\\zlib1.dll" OR ImageLoaded="*\\zlibwapi.dll"
OR ImageLoaded="*\\bzip2.dll" OR ImageLoaded="*\\libbzip2.dll" OR ImageLoaded="*\\libzip.dll")
NOT (Image="*\\7z.exe" OR Image="*\\7zG.exe" OR Image="*\\WinRAR.exe" OR Image="*\\msiexec.exe")
NOT (ImageLoaded="*\\System32\\*" OR ImageLoaded="*\\SysWOW64\\*"))
OR
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*IO.Compression*" OR CommandLine="*GZipStream*" OR CommandLine="*DeflateStream*"
OR CommandLine="*ZipArchive*" OR CommandLine="*ZipFile*" OR CommandLine="*ICSharpCode*"))
OR
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\python.exe" OR Image="*\\python3.exe")
(CommandLine="*import zlib*" OR CommandLine="*import bz2*" OR CommandLine="*import gzip*"
OR CommandLine="*import zipfile*" OR CommandLine="*import rarfile*" OR CommandLine="*zlib.compress*"
OR CommandLine="*bz2.compress*" OR CommandLine="*import lzma*" OR CommandLine="*import tarfile*"))
OR
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.gz" OR TargetFilename="*.bz2" OR TargetFilename="*.zlib" OR TargetFilename="*.lzma" OR TargetFilename="*.xz")
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\AppData\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Users\\Public\\*")
(Image="*\\python.exe" OR Image="*\\python3.exe" OR Image="*\\ruby.exe" OR Image="*\\perl.exe"
OR Image="*\\node.exe" OR Image="*\\java.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe"))
)
| eval DetectionSource=case(
EventCode=7, "CompressionDllLoad",
EventCode=1 AND (match(Image, "powershell") OR match(Image, "pwsh")), "PowerShellLibraryCompression",
EventCode=1 AND match(Image, "python"), "PythonLibraryCompression",
EventCode=11, "StagedCompressedFileCreation",
true(), "Unknown"
)
| eval ProcessPath=coalesce(Image, "")
| eval CmdLine=coalesce(CommandLine, ParentCommandLine, "")
| eval Artifact=coalesce(ImageLoaded, TargetFilename, "")
| table _time, host, User, DetectionSource, ProcessPath, CmdLine, Artifact, ParentImage, ParentCommandLine
| sort - _timeMulti-signal detection using Sysmon events across four branches: Event ID 7 (ImageLoaded) for compression DLLs (zlib, bzip2, libzip) loaded outside known-good archiver install paths; Event ID 1 (Process Create) for PowerShell using .NET System.IO.Compression classes; Event ID 1 for Python processes with compression library imports in command line; Event ID 11 (File Create) for compressed file artifacts written to staging paths by scripting interpreters. The DetectionSource field identifies which branch fired for triage prioritization.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate Python data science or ETL pipelines compressing output files using zlib or gzip
- Software installers and package managers (pip, conda, npm) that load compression libraries during package installation
- PowerShell-based backup or log archival scripts using System.IO.Compression.GZipStream
- Developer IDEs and build tools (Maven, Gradle, PyCharm) loading compression libraries during build and packaging operations
- Monitoring agents compressing telemetry payloads before transmission
Other platforms for T1560.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Python zlib Compression of Sensitive File Collection
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'import zlib' and 'zlib.compress'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.zlib. DeviceFileEvents: FileCreated action for the .zlib output file. DeviceFileEvents: FileRead action for the hosts file.
- Test 2PowerShell GZipStream Compression via System.IO.Compression
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'IO.Compression', 'GZipStream', 'MemoryStream', and 'CompressionMode'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.gz. PowerShell ScriptBlock Log Event ID 4104 with full .NET compression code.
- Test 3Python bzip2 Multi-File Collection and Compression
Expected signal: Syslog/auditd: python3 process execution with command line containing 'import bz2', 'tarfile', and output path in /tmp. File creation event for /tmp/stage_df00.tar.bz2. Auditd syscall events: openat for source files, write for output file. Linux process accounting: python3 with suspicious file access pattern.
- Test 4Python rarfile Library Compression (Third-Party Library)
Expected signal: Sysmon Event ID 1: python.exe with CommandLine containing 'import zipfile', 'ZIP_DEFLATED', and temp path. Sysmon Event ID 11: File Create for %TEMP%\stage_df00_lib.zip. Potential child process for pip install subprocess. DeviceFileEvents shows file read of hosts file and write of .zip artifact.
References (12)
- https://attack.mitre.org/techniques/T1560/002/
- https://github.com/madler/zlib
- https://libzip.org/
- https://pypi.org/project/rarfile/
- https://learn.microsoft.com/en-us/dotnet/api/system.io.compression
- https://securelist.com/kaspersky-lab-discovers-the-tajmahal-apt-framework/90240/
- https://www.welivesecurity.com/2024/05/23/eset-research-unveils-lunar-toolset-diplomatic-espionage/
- https://unit42.paloaltonetworks.com/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/
- https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.002/T1560.002.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1560.002 including response playbook, investigation guide, and atomic red team tests.