Compressing data using python

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Archive Collected Data: Archive via Library (T1560.002)
Severity	Low

Description

Usage of a Python module to compress files.

Attacker's Goals

Collecting and staging data before exfiltration.

Investigative actions

Investigate the process and command line for access to sensitive files.