Skip to content
Atomic Red Team
atomics
T1560.002

T1560.002 - Archive Collected Data: Archive via Library

Description from ATT&CK (opens in a new tab)

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python (opens in a new tab) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.

Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

Atomic Tests


Atomic Test #1 - Compressing data using GZip in Python (FreeBSD/Linux)

Uses GZip from Python to compress files

Supported Platforms: Linux

auto_generated_guid: 391f5298-b12d-4636-8482-35d9c17d53a8

Inputs:

NameDescriptionTypeDefault Value
path_to_input_filePath to the file that you want to compresspath/etc/passwd
path_to_output_filePath of the file that you want your .gz file to bepath/tmp/passwd.gz

Attack Commands: Run with sh!

which_python=`which python || which python3`
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"

Cleanup Commands:

rm #{path_to_output_file}

Dependencies: Run with sh!

Description: Requires Python
Check Prereq Commands:
which python || which python3
Get Prereq Commands:
echo "please install python to run this test"; exit 1


Atomic Test #2 - Compressing data using bz2 in Python (FreeBSD/Linux)

Uses bz2 from Python to compress files

Supported Platforms: Linux

auto_generated_guid: c75612b2-9de0-4d7c-879c-10d7b077072d

Inputs:

NameDescriptionTypeDefault Value
path_to_input_filePath to the file that you want to compresspath/etc/passwd
path_to_output_filePath of the file that you want your .bz2 file to bepath/tmp/passwd.bz2

Attack Commands: Run with sh!

which_python=`which python || which python3`
$which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(str(bz2content));output_file.close();"

Cleanup Commands:

rm #{path_to_output_file}

Dependencies: Run with sh!

Description: Requires Python
Check Prereq Commands:
which python || which python3
Get Prereq Commands:
echo "please install python to run this test"; exit 1


Atomic Test #3 - Compressing data using zipfile in Python (FreeBSD/Linux)

Uses zipfile from Python to compress files

Supported Platforms: Linux

auto_generated_guid: 001a042b-859f-44d9-bf81-fd1c4e2200b0

Inputs:

NameDescriptionTypeDefault Value
path_to_input_filePath to the file that you want to compresspath/etc/passwd
path_to_output_filePath of the file that you want your .zip file to bepath/tmp/passwd.zip

Attack Commands: Run with sh!

which_python=`which python || which python3`
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"

Cleanup Commands:

rm #{path_to_output_file}

Dependencies: Run with sh!

Description: Requires Python
Check Prereq Commands:
which python || which python3
Get Prereq Commands:
echo "please install python to run this test"; exit 1


Atomic Test #4 - Compressing data using tarfile in Python (FreeBSD/Linux)

Uses tarfile from Python to compress files

Supported Platforms: Linux

auto_generated_guid: e86f1b4b-fcc1-4a2a-ae10-b49da01458db

Inputs:

NameDescriptionTypeDefault Value
path_to_input_filePath to the file that you want to compresspath/etc/passwd
path_to_output_filePath of the file that you want your .tar.gz file to bepath/tmp/passwd.tar.gz

Attack Commands: Run with sh!

which_python=`which python || which python3`
$which_python -c "import tarfile; output_file = tarfile.open('#{path_to_output_file}','w'); output_file.add('#{path_to_input_file}'); output_file.close()"

Cleanup Commands:

rm #{path_to_output_file}

Dependencies: Run with sh!

Description: Requires Python
Check Prereq Commands:
which python || which python3
Get Prereq Commands:
echo "please install python to run this test"; exit 1