Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code tar</code on Linux and macOS or <code zip</code on Windows systems. On Windows, <code diantz</code or <code makecab</code may be used to package collected files into a cabinet (.cab) file. <code diantz</code may also be used to download and compress files from remote locations (i.e. Remote Data Staging).(Citation: diantz.exe lolbas) <code xcopy</code on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7 Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)