Detect Archive via Library in Sumo Logic CSE
Adversaries may compress or encrypt collected data prior to exfiltration using third-party or built-in programming libraries rather than standalone archival utilities. Libraries such as Python's zlib, bzip2, gzip, zipfile, and rarfile modules; .NET's System.IO.Compression (GZipStream, DeflateStream, ZipArchive); C libraries libzip and zlib; and platform-native libraries enable adversaries to compress and encrypt data programmatically within a running process. Because no separate archival utility process (7-Zip, WinRAR, tar) is spawned, this technique evades detections focused on command-line archivers. Malware families including TajMahal, LunarWeb, SeaDuke, BBSRAT, InvisiMole, and Denis have all used library-based compression to stage and exfiltrate collected data.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1560 Archive Collected Data
- Sub-technique
- T1560.002 Archive via Library
- Canonical reference
- https://attack.mitre.org/techniques/T1560/002/
Sumo Detection Query
(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlogbeat*)
| where !isNull(%"EventID")
| where %"EventID" in ("1", "7", "11")
| where
(
%"EventID" = "7"
AND matches(%"ImageLoaded", "(?i).*(zlib\.dll|zlib1\.dll|zlibwapi\.dll|bzip2\.dll|libbzip2\.dll|libzip\.dll|minizip\.dll)$")
AND !matches(%"ImageLoaded", "(?i).*(system32|syswow64|7-zip|winrar).*")
AND !matches(%"Image", "(?i).*(7z\.exe|7zg\.exe|winrar\.exe|msiexec\.exe)$")
) OR (
%"EventID" = "1"
AND matches(%"Image", "(?i).*(powershell\.exe|pwsh\.exe)$")
AND matches(%"CommandLine", "(?i).*(IO\.Compression|GZipStream|DeflateStream|ZipArchive|ZipFile|ICSharpCode|DotNetZip|System\.IO\.Compression).*")
) OR (
%"EventID" = "1"
AND matches(%"Image", "(?i).*python[0-9]*\.exe$")
AND matches(%"CommandLine", "(?i).*(import zlib|import bz2|import gzip|import zipfile|import rarfile|zlib\.compress|bz2\.compress|import lzma|import tarfile).*")
) OR (
%"EventID" = "11"
AND matches(%"TargetFilename", "(?i).*\.(gz|bz2|zlib|lzma|xz|lz)$")
AND matches(%"TargetFilename", "(?i).*(temp|appdata|programdata|users.public).*")
AND matches(%"Image", "(?i).*(python[0-9]*\.exe|ruby\.exe|perl\.exe|node\.exe|java\.exe|javaw\.exe|wscript\.exe|cscript\.exe|mshta\.exe)$")
)
| eval DetectionSource = if(%"EventID" = "7", "CompressionDllLoad",
if(%"EventID" = "1" AND matches(%"Image", "(?i).*(powershell|pwsh).*"), "PowerShellLibraryCompression",
if(%"EventID" = "1" AND matches(%"Image", "(?i).*python.*"), "PythonLibraryCompression",
if(%"EventID" = "11", "StagedCompressedFileCreation", "Unknown"))))
| fields _time, Computer, %"User", DetectionSource, %"Image", %"CommandLine", %"ImageLoaded", %"TargetFilename", %"ParentImage"
| sort by _time descSumo Logic detection for T1560.002 querying Sysmon events (EventIDs 1, 7, 11) ingested via Installed Collector or Winlogbeat HTTP source. Uses matches() with Java regex to identify compression library DLL loads outside trusted paths, PowerShell and Python in-process compression API usage, and scripting interpreter creation of compressed archives in staging directories. Uses %"field" syntax for Sysmon custom field references.
Data Sources
Required Tables
False Positives & Tuning
- CI/CD pipeline agents (Jenkins, GitHub Actions self-hosted runners) executing Python or Node.js build scripts that compress artifacts to temp directories as part of packaging workflows
- PowerShell-based endpoint management tooling (SCCM, Ansible over WinRM) using System.IO.Compression to package diagnostic bundles or software deployment archives
- Application frameworks with embedded runtimes (Electron, embedded JRE, PyInstaller-packaged apps) that load compression DLLs from application-local directories during startup
Other platforms for T1560.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Python zlib Compression of Sensitive File Collection
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'import zlib' and 'zlib.compress'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.zlib. DeviceFileEvents: FileCreated action for the .zlib output file. DeviceFileEvents: FileRead action for the hosts file.
- Test 2PowerShell GZipStream Compression via System.IO.Compression
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'IO.Compression', 'GZipStream', 'MemoryStream', and 'CompressionMode'. Sysmon Event ID 11: File Create for %TEMP%\stage_df00.gz. PowerShell ScriptBlock Log Event ID 4104 with full .NET compression code.
- Test 3Python bzip2 Multi-File Collection and Compression
Expected signal: Syslog/auditd: python3 process execution with command line containing 'import bz2', 'tarfile', and output path in /tmp. File creation event for /tmp/stage_df00.tar.bz2. Auditd syscall events: openat for source files, write for output file. Linux process accounting: python3 with suspicious file access pattern.
- Test 4Python rarfile Library Compression (Third-Party Library)
Expected signal: Sysmon Event ID 1: python.exe with CommandLine containing 'import zipfile', 'ZIP_DEFLATED', and temp path. Sysmon Event ID 11: File Create for %TEMP%\stage_df00_lib.zip. Potential child process for pip install subprocess. DeviceFileEvents shows file read of hosts file and write of .zip artifact.
References (12)
- https://attack.mitre.org/techniques/T1560/002/
- https://github.com/madler/zlib
- https://libzip.org/
- https://pypi.org/project/rarfile/
- https://learn.microsoft.com/en-us/dotnet/api/system.io.compression
- https://securelist.com/kaspersky-lab-discovers-the-tajmahal-apt-framework/90240/
- https://www.welivesecurity.com/2024/05/23/eset-research-unveils-lunar-toolset-diplomatic-espionage/
- https://unit42.paloaltonetworks.com/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/
- https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.002/T1560.002.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1560.002 including response playbook, investigation guide, and atomic red team tests.