Detect Archive Collected Data in IBM QRadar
Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration and can be performed using a utility, third-party library, or custom method. Common tools include 7-Zip, WinRAR, the Windows built-in compact and certutil utilities, PowerShell Compress-Archive and .NET IO.Compression classes, and tar/gzip/openssl on Linux and macOS. Threat actors including Dragonfly, Lazarus Group, Ember Bear, BlackByte, and Axiom have all used archiving and encryption as a pre-exfiltration staging step. Sub-techniques cover archive via utility (T1560.001), archive via library (T1560.002), and archive via custom method (T1560.003).
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1560 Archive Collected Data
- Canonical reference
- https://attack.mitre.org/techniques/T1560/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
LOGSOURCENAME(logsourceid) AS log_source,
username,
"Process Name" AS process_name,
"Process Command Line" AS command_line,
"Parent Process Name" AS parent_process,
CASE
WHEN LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
AND (LOWER("Process Command Line") LIKE '% -hp%'
OR LOWER("Process Command Line") LIKE '%-pass%'
OR LOWER("Process Command Line") LIKE '%-password%')
THEN 'Password-Protected Archive'
WHEN LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
AND LOWER("Parent Process Name") LIKE ANY ('%\\winword.exe', '%\\excel.exe', '%\\outlook.exe',
'%\\powerpnt.exe', '%\\mshta.exe', '%\\wscript.exe', '%\\cscript.exe',
'%\\mmc.exe', '%\\regsvr32.exe', '%\\rundll32.exe')
THEN 'Archive via Suspicious Parent'
WHEN LOWER("Process Name") LIKE ANY ('%\\powershell.exe', '%\\pwsh.exe')
AND (LOWER("Process Command Line") LIKE '%compress-archive%'
OR LOWER("Process Command Line") LIKE '%io.compression%'
OR LOWER("Process Command Line") LIKE '%gzipstream%'
OR LOWER("Process Command Line") LIKE '%deflatestream%'
OR LOWER("Process Command Line") LIKE '%ziparchive%')
THEN 'PowerShell .NET Compression'
WHEN LOWER("Process Name") LIKE '%\\certutil.exe'
AND (LOWER("Process Command Line") LIKE '%-encode%'
OR LOWER("Process Command Line") LIKE '%-encodehex%')
THEN 'CertUtil Encoding'
ELSE 'Suspicious Archive Activity'
END AS detection_type
FROM events
WHERE
devicetime > NOW() - 86400000
AND (
(
LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
AND (
LOWER("Process Command Line") LIKE '% -hp%'
OR LOWER("Process Command Line") LIKE '%-pass%'
OR LOWER("Process Command Line") LIKE '%-password%'
OR LOWER("Parent Process Name") LIKE ANY (
'%\\winword.exe', '%\\excel.exe', '%\\outlook.exe', '%\\powerpnt.exe',
'%\\mshta.exe', '%\\wscript.exe', '%\\cscript.exe',
'%\\mmc.exe', '%\\regsvr32.exe', '%\\rundll32.exe'
)
)
)
OR (
LOWER("Process Name") LIKE ANY ('%\\powershell.exe', '%\\pwsh.exe')
AND (
LOWER("Process Command Line") LIKE '%compress-archive%'
OR LOWER("Process Command Line") LIKE '%io.compression%'
OR LOWER("Process Command Line") LIKE '%gzipstream%'
OR LOWER("Process Command Line") LIKE '%deflatestream%'
OR LOWER("Process Command Line") LIKE '%ziparchive%'
)
)
OR (
LOWER("Process Name") LIKE '%\\certutil.exe'
AND (
LOWER("Process Command Line") LIKE '%-encode%'
OR LOWER("Process Command Line") LIKE '%-encodehex%'
)
)
)
ORDER BY devicetime DESCIBM QRadar AQL detection for T1560 Archive Collected Data. Queries normalized process creation events (sourced from Sysmon EventCode 1 or Windows Security 4688 log sources with command-line auditing enabled) for four indicator patterns: password-protected archive creation, archive tools spawned by Office or scripting engine parents, PowerShell .NET compression class usage, and CertUtil base64 encoding. Produces a labeled detection_type column for triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Automated patch management systems (WSUS, ManageEngine, Ivanti) that use PowerShell Compress-Archive to bundle patches before deployment — verify against known patching service accounts and scheduled maintenance windows
- Enterprise DLP or CASB tooling that invokes CertUtil to encode files during content inspection workflows — cross-reference log source IP against known DLP infrastructure
- Password-protected archive creation by end users for legitimate file sharing via email or file transfer portals — high volume on specific hosts during business hours with consistent users suggests non-malicious activity
Other platforms for T1560
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 7-Zip Password-Protected Archive of Sensitive Directory
Expected signal: Sysmon Event ID 1: Process Create with Image ending in 7z.exe, CommandLine containing '-hp' and 'staged_exfil.zip'. Sysmon Event ID 11: File Create event for C:\Windows\Temp\staged_exfil.zip with InitiatingProcessFileName=7z.exe. Security Event ID 4688 (if process command line auditing enabled) with same details.
- Test 2 PowerShell Compress-Archive Staging in Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Compress-Archive' and 'C:\Windows\Temp\recent_files_staged.zip'. Sysmon Event ID 11: File Create for the zip archive. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational with full cmdlet and path.
- Test 3 certutil Base64 Encode Binary File
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-encode' and 'encoded_payload.txt'. Sysmon Event ID 11: File Create for C:\Windows\Temp\encoded_payload.txt. Security Event ID 4688 with the same certutil command line if process auditing is enabled.
- Test 4 Linux tar + gzip Collection and Staging
Expected signal: Auditd execve record: type=EXECVE with argv containing 'tar' 'czf' '/tmp/sys_backup_...' '/etc/passwd' '/etc/shadow'. Syslog process creation record (if auditd not deployed). File creation event for /tmp/sys_backup_*.tar.gz. If using a SIEM with Linux file integrity monitoring, alert on new file creation in /tmp matching *.tar.gz by root or privileged account.
- Test 5 WinRAR Archive with Password and Locked Headers
Expected signal: Sysmon Event ID 1: Process Create with Image ending rar.exe, CommandLine containing '-hp' and 'staging.rar'. Sysmon Event ID 11: File Create for C:\ProgramData\Microsoft\staging.rar with InitiatingProcessFileName=rar.exe. Security Event ID 4688 with full command line.
References (11)
- https://attack.mitre.org/techniques/T1560/
- https://attack.mitre.org/techniques/T1560/001/
- https://attack.mitre.org/techniques/T1560/002/
- https://attack.mitre.org/techniques/T1560/003/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
- https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf
- https://www.cisa.gov/sites/default/files/publications/AA18-074A_MAR-10135536-G.PDF
- https://securelist.com/toddycat-check-logs/110696/
- https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Response Playbook
Triage
- Examine the full command line — identify: which tool was used, what source paths were archived, where the output archive was written, and whether a password was supplied. The destination path is critical: archives written to temp dirs, network shares, or cloud sync folders are high-priority
- Identify the parent process — was the archive tool spawned interactively (explorer.exe parent), by a scheduled task, by a scripting engine (wscript.exe, powershell.exe), or by an Office application? Non-interactive parents with no corresponding change ticket indicate automated collection
- Determine whether the archive was password-protected — the presence of -hp (7-Zip header encryption), -p<password>, or -pass arguments strongly indicates the adversary is preparing for exfiltration and wishes to evade content inspection
- Check the user context — is this a privileged account, service account, or domain admin? Archiving by service accounts or machine accounts ($) on servers is unusual and warrants immediate escalation
- Review the timeline around the archive event: look for preceding data collection activity (large directory listings, xcopy/robocopy, database dump utilities, BloodHound or SharpHound execution) within the same session
- Verify whether the archive file still exists on disk (DeviceFileEvents or Sysmon EID 11) and whether any network transfer of the archive occurred within 10 minutes of creation (DeviceNetworkEvents correlated by DeviceName and time window)
Containment
- If network transfer of the archive is confirmed: immediately isolate the endpoint via EDR network isolation or emergency VLAN change to prevent further exfiltration
- If the archive file is still present on disk: preserve it as evidence before any remediation — copy to secure evidence store with hash verification. Do NOT delete until legal/forensics sign off
- If compromised credentials are suspected: disable the account in Active Directory, revoke active SSO/OAuth sessions and tokens, and force password reset for all accounts the user had access to
- Block the archive file extension at DLP and proxy level if exfiltration vector is identified (HTTP POST, FTP, cloud storage upload) — apply to the specific destination domain or IP
- If lateral movement preceded the archiving: extend the isolation and investigation scope to all systems the account accessed in the preceding 48 hours
- If the archive contained credential material (NTDS.dit, SAM hive, LSASS dump, password vault exports): treat as full credential compromise and initiate emergency password reset for all domain accounts
Evidence Collection
- Full process tree for the archive execution: parent, grandparent, and any child processes spawned — Sysmon EID 1 or Security EID 4688 (requires process command line auditing via GPO)
- The archive command line in full — record the exact tool name, arguments, source paths, destination path, and any password argument (redact password before sharing outside IR team)
- The archive file itself if still present — collect with hash (MD5, SHA256), creation timestamp, file size, and owner. Attempt to open/inspect contents if no password was set
- Sysmon EID 11 (File Create) for the time window around the archive event — identifies all files written by the process, including intermediate staging files
- Network connection logs (Sysmon EID 3 or DeviceNetworkEvents) for the 15-minute window post-archive-creation — look for outbound connections from the archive process or any subsequent process carrying the archive name
- Prefetch files for the archive tool at C:\Windows\Prefetch\7Z.EXE-*.pf, RAR.EXE-*.pf — contain execution timestamps and file paths of recently accessed archives
- Security EID 4663 (Object Access) if file auditing is enabled on the source directories — identifies exactly which files the adversary read before archiving
- DLP and proxy logs for any HTTP/HTTPS POST, FTP transfer, or cloud storage (OneDrive, Dropbox, S3) upload matching the archive file size in the 30 minutes following archive creation
Escalation Criteria
- !Archive source paths include sensitive data stores: NTDS.dit, SAM hive, LSASS memory dump, password manager vaults, source code repositories, finance or HR data directories
- !Archive file was transferred off-system — network connection detected post-creation to an external IP or cloud storage endpoint
- !Archive was password-protected with a non-standard password (not a known backup password) indicating deliberate adversary obfuscation
- !Archiving executed by a service account, SYSTEM, or machine account with no corresponding authorised backup or maintenance window
- !Multiple systems showing archiving activity within the same 30-minute window — indicates a coordinated, potentially scripted collection campaign
- !Archive tool was spawned by an Office application, scripting engine, or any LOLBin — indicates exploitation of a macro, phishing payload, or script-based initial access
- !Archive contents include AD reconnaissance output (BloodHound zip, SharpHound zip) — indicates credential or lateral movement preparation
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Prefetch: C:\Windows\Prefetch\7Z.EXE-*.pf, RAR.EXE-*.pf, WINRAR.EXE-*.pf — execution timestamps and file path hashes of accessed archives - >
Registry: HKCU\Software\7-Zip\FM\PanelPath0 and PanelPath1 — most recently browsed directories in 7-Zip file manager - >
Registry: HKCU\Software\WinRAR\DialogEditHistory\ArcName — recent archive names used in WinRAR dialogs - >
Registry: HKCU\Software\WinRAR\DialogEditHistory\ExtrPath — recent extraction paths - >
MFT ($MFT) / USN Journal ($UsnJrnl) — archive file creation, modification, and deletion timestamps; recoverable even if archive was deleted - >
Windows Search Index (C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb) — may have indexed archive file names and paths - >
PowerShell history: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — records Compress-Archive cmdlet invocations - >
PowerShell ScriptBlock Log (Event ID 4104 in Microsoft-Windows-PowerShell/Operational) — full deobfuscated content of any Compress-Archive or IO.Compression code - >
Sysmon EID 11 (File Create) records in EVTX — shows archive file creation with initiating process details - >
ShimCache / AmCache (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache, C:\Windows\appcompat\Programs\Amcache.hve) — evidence of archive tool execution even if prefetch was cleared - >
Linux: /var/log/audit/audit.log (auditd execve records) for tar, gzip, zip, openssl enc commands - >
Linux: ~/.bash_history or ~/.zsh_history — command-line history for archive/encryption commands
Tuning Guidance
Start by baselining which accounts, systems, and time windows archive operations are expected in your environment. Backup servers and backup service accounts will generate significant volume — build an allowlist by account name (matching your backup service account naming convention) AND parent process (e.g., backup agent executable) to suppress these. For password-protected archive detection, the -hp flag (header encryption) is the cleanest signal with very few legitimate uses — this can run with minimal tuning. The -p flag is noisier; require it to be combined with suspicious parent processes or unusual user context before alerting. For PowerShell Compress-Archive, build an allowlist of known deployment automation scripts by their exact command-line hash or parent process. On developer workstations, Compress-Archive usage will be frequent — consider scoping the detection to exclude devices in developer device groups if you manage device tagging in MDE. For certutil -encode, legitimate PKI admin use always involves certificate file extensions (.cer, .crt, .p7b); add a filter for ProcessCommandLine has_any (".cer", ".crt", ".p7b", ".pfx") to suppress these. On Linux endpoints, baseline which users run tar/gzip/zip and add auditd rules targeting archive tool execve calls on servers where archiving is not expected. Consider pairing this detection with T1041/T1048 network exfiltration detections to build a compound alert: archive creation followed within 10 minutes by large outbound data transfer is a much higher-fidelity signal than archiving alone.
Hunting Queries
Hunt for archive files created in staging and temp directories by processes that are not standard archive utilities. This catches malware, custom scripts, or LOLBins writing archives as a staging step before exfiltration, which the main process-based detection may miss if the archiving code is embedded rather than invoking a standalone tool.
// Hunt 1: Archive files created in staging/temp directories by non-archive processes
// Catches adversaries using custom scripts, malware, or LOLBins to create archives
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any (".zip", ".7z", ".rar", ".gz", ".tar", ".bz2", ".cab", ".lzh")
| where FolderPath has_any ("\\temp\\", "\\tmp\\", "\\windows\\temp\\", "\\appdata\\local\\temp\\", "\\users\\public\\", "\\programdata\\")
| where InitiatingProcessFileName !in~ ("7z.exe", "7za.exe", "7zr.exe", "winrar.exe", "rar.exe", "explorer.exe", "msiexec.exe", "setup.exe", "install.exe")
| where FileSize > 102400 // > 100KB to filter trivial archives
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, FileSize,
InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.zip" OR TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.gz" OR TargetFilename="*.tar" OR TargetFilename="*.cab")
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Windows\\Temp\\*")
NOT (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\winrar.exe" OR Image="*\\rar.exe" OR Image="*\\explorer.exe" OR Image="*\\msiexec.exe")
| table _time, host, User, Image, CommandLine, TargetFilename
| sort - _timeHunt for archive utility execution under service accounts, SYSTEM, or machine accounts. Legitimate scheduled backup jobs will typically appear at consistent times with consistent command lines — deviations (new times, new paths, new password arguments) warrant investigation. This catches adversaries who have compromised service accounts to run data collection and staging tasks.
// Hunt 2: Archive tool usage by service accounts, SYSTEM, or machine accounts on servers
// Legitimate backup jobs are typically scheduled and expected — unexpected invocations are high-priority
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe")
| where AccountName endswith "$"
or AccountName =~ "SYSTEM"
or AccountName has_any ("svc", "service", "backup", "agent")
| summarize
ArchiveCount = count(),
UniqueCommands = dcount(ProcessCommandLine),
Commands = make_set(ProcessCommandLine, 10),
Parents = make_set(InitiatingProcessFileName, 5),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, AccountName, FileName
| sort by ArchiveCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe")
| where match(User, "(?i)(system|\$$|svc|service|backup|agent)")
| stats count as ArchiveCount, dc(CommandLine) as UniqueCommands, values(CommandLine) as Commands,
values(ParentImage) as Parents, earliest(_time) as FirstSeen, latest(_time) as LastSeen
by host, User, Image
| sort - ArchiveCountHunt for anomalous spikes in daily archiving activity per device and account, using a 14-day baseline. A single day with 3x the normal archive frequency or more than 5 archive operations on a device that rarely archives suggests bulk data staging. This catches adversaries who use existing archive tools that are present in the environment but run them at an unusual scale or cadence.
// Hunt 3: Spike detection — unusual frequency of archiving activity per device in a single day
// Adversaries staging large data collections will often run many archive operations in a short window
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe", "compact.exe")
| summarize
DailyCount = count(),
UniqueSourcePaths = dcount(ProcessCommandLine),
Commands = make_set(ProcessCommandLine, 20)
by DeviceName, AccountName, bin(Timestamp, 1d)
| summarize
AvgDaily = avg(DailyCount),
MaxDaily = max(DailyCount),
DaysObserved = count()
by DeviceName, AccountName
| where MaxDaily > AvgDaily * 3 and MaxDaily > 5
| sort by MaxDaily descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe" OR Image="*\\compact.exe")
| bucket span=1d _time
| stats count as DailyCount, dc(CommandLine) as UniqueCommands by host, User, _time
| stats avg(DailyCount) as AvgDaily, max(DailyCount) as MaxDaily, count as DaysObserved by host, User
| where MaxDaily > (AvgDaily * 3) AND MaxDaily > 5
| sort - MaxDailyAtomic Red Team Tests
Creates a password-protected 7-Zip archive of the current user's Documents folder using the -hp flag (which encrypts both file contents and archive headers). The -hp flag is a strong indicator of deliberate data hiding for exfiltration, as it prevents forensic tools from reading file names inside the archive without the password. Uses a staging path in the Windows Temp directory, a common adversary staging location.
Command
7z.exe a -tzip -hp"Adv3rsaryP@ss" -mx=5 C:\Windows\Temp\staged_exfil.zip C:\Users\%USERNAME%\Documents\*.docx C:\Users\%USERNAME%\Documents\*.xlsxCleanup
del /f /q C:\Windows\Temp\staged_exfil.zipExpected Telemetry
Sysmon Event ID 1: Process Create with Image ending in 7z.exe, CommandLine containing '-hp' and 'staged_exfil.zip'. Sysmon Event ID 11: File Create event for C:\Windows\Temp\staged_exfil.zip with InitiatingProcessFileName=7z.exe. Security Event ID 4688 (if process command line auditing enabled) with same details.
Expected Detection
Alert fires on PasswordProtected detection branch: ProcessCommandLine contains '-hp'. KQL: DetectionType='Password-Protected Archive', RiskLevel='High'. SPL: PasswordProtected=1, SuspicionScore=1.
Uses the built-in PowerShell Compress-Archive cmdlet to collect and compress files into a staging directory. This technique requires no third-party tools and is increasingly used by adversaries leveraging living-off-the-land approaches. The destination path in Windows Temp mimics pre-exfiltration staging behaviour seen in Lazarus Group and BlackByte intrusions.
Command
powershell.exe -NoProfile -Command "Compress-Archive -Path C:\Users\$env:USERNAME\AppData\Roaming\Microsoft\Windows\Recent -DestinationPath C:\Windows\Temp\recent_files_staged.zip -Force"Cleanup
Remove-Item C:\Windows\Temp\recent_files_staged.zip -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Compress-Archive' and 'C:\Windows\Temp\recent_files_staged.zip'. Sysmon Event ID 11: File Create for the zip archive. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational with full cmdlet and path.
Expected Detection
Alert fires on PSCompression detection branch: ProcessCommandLine contains 'Compress-Archive'. KQL: DetectionType='PowerShell .NET Compression', RiskLevel='Medium'. SPL: PSCompression=1, SuspicionScore=1.
Uses the built-in Windows certutil.exe utility to base64-encode a binary file, converting it to ASCII text. This technique is used by adversaries to prepare binary payloads or collected data for exfiltration over text channels (HTTP body, email, clipboard). The encoded output can be decoded on the attacker's system with certutil -decode or standard base64 tooling. This was observed in multiple APT intrusions as a data staging step.
Command
certutil.exe -encode C:\Windows\System32\notepad.exe C:\Windows\Temp\encoded_payload.txt && echo Encoded file size: && for %i in (C:\Windows\Temp\encoded_payload.txt) do echo %~zi bytesCleanup
del /f /q C:\Windows\Temp\encoded_payload.txtExpected Telemetry
Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-encode' and 'encoded_payload.txt'. Sysmon Event ID 11: File Create for C:\Windows\Temp\encoded_payload.txt. Security Event ID 4688 with the same certutil command line if process auditing is enabled.
Expected Detection
Alert fires on CertutilEncoding detection branch: ProcessCommandLine has '-encode'. KQL: DetectionType='CertUtil Base64 Encoding', RiskLevel='Medium'. SPL: CertutilEncode=1, SuspicionScore=1.
Uses the native tar utility with gzip compression to collect sensitive system files into a staging archive in /tmp. This pattern is observed in Linux server intrusions where adversaries collect /etc credentials, application configs, and log files before exfiltration. The archive name includes a timestamp to mimic legitimate log rotation or backup script output.
Command
tar czf /tmp/sys_backup_$(date +%Y%m%d%H%M%S).tar.gz /etc/passwd /etc/shadow /etc/hosts /etc/ssh/ssh_host_* /root/.bash_history 2>/dev/null; ls -lh /tmp/sys_backup_*.tar.gzCleanup
rm -f /tmp/sys_backup_*.tar.gzExpected Telemetry
Auditd execve record: type=EXECVE with argv containing 'tar' 'czf' '/tmp/sys_backup_...' '/etc/passwd' '/etc/shadow'. Syslog process creation record (if auditd not deployed). File creation event for /tmp/sys_backup_*.tar.gz. If using a SIEM with Linux file integrity monitoring, alert on new file creation in /tmp matching *.tar.gz by root or privileged account.
Expected Detection
Detection via auditd execve rules monitoring for tar with -z or -j flags collecting from /etc, /root, or /home paths into /tmp. Syslog sourcetype in Splunk: search for 'tar' with 'czf' or 'cjf' and destination path '/tmp/' in process audit records.
Uses WinRAR command-line interface to create a password-protected archive with header encryption (-hp), compressing a sensitive directory and writing the output to a staging location under ProgramData. The -ep1 flag strips leading directory paths to obfuscate the original file structure. This pattern was observed in Dragonfly and HAFNIUM intrusions for pre-exfiltration data packaging.
Command
rar.exe a -hp"C0mp!ex#Pass" -ep1 -m5 C:\ProgramData\Microsoft\staging.rar C:\Users\%USERNAME%\Desktop\*.* C:\Users\%USERNAME%\Documents\*.*Cleanup
del /f /q C:\ProgramData\Microsoft\staging.rarExpected Telemetry
Sysmon Event ID 1: Process Create with Image ending rar.exe, CommandLine containing '-hp' and 'staging.rar'. Sysmon Event ID 11: File Create for C:\ProgramData\Microsoft\staging.rar with InitiatingProcessFileName=rar.exe. Security Event ID 4688 with full command line.
Expected Detection
Alert fires on PasswordProtected detection branch: ProcessCommandLine matches regex for -p prefix or contains '-hp'. KQL: DetectionType='Password-Protected Archive'. SPL: PasswordProtected=1, SuspicionScore=1.