# T1560.002 - Archive via Library
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1560/002)
<blockquote>An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.

Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Compressing data using GZip in Python (Linux)](#atomic-test-1---compressing-data-using-gzip-in-python-linux)

- [Atomic Test #2 - Compressing data using bz2 in Python (Linux)](#atomic-test-2---compressing-data-using-bz2-in-python-linux)

- [Atomic Test #3 - Compressing data using zipfile in Python (Linux)](#atomic-test-3---compressing-data-using-zipfile-in-python-linux)

- [Atomic Test #4 - Compressing data using tarfile in Python (Linux)](#atomic-test-4---compressing-data-using-tarfile-in-python-linux)


<br/>

## Atomic Test #1 - Compressing data using GZip in Python (Linux)
Uses GZip from Python to compress files

**Supported Platforms:** Linux


**auto_generated_guid:** 391f5298-b12d-4636-8482-35d9c17d53a8





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_input_file | Path to the file that you want to compress | Path | /etc/passwd|
| path_to_output_file | Path of the file that you want your .gz file to be | Path | /tmp/passwd.gz|


#### Attack Commands: Run with `bash`! 


```bash
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb','compresslevel=6');output_file.write(content);output_file.close();"
```

#### Cleanup Commands:
```bash
rm #{path_to_output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: Requires Python
##### Check Prereq Commands:
```bash
which_python=`which python`; $which_python -V
```
##### Get Prereq Commands:
```bash

```




<br/>
<br/>

## Atomic Test #2 - Compressing data using bz2 in Python (Linux)
Uses bz2 from Python to compress files

**Supported Platforms:** Linux


**auto_generated_guid:** c75612b2-9de0-4d7c-879c-10d7b077072d





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_input_file | Path to the file that you want to compress | Path | /etc/passwd|
| path_to_output_file | Path of the file that you want your .bz2 file to be | Path | /tmp/passwd.bz2|


#### Attack Commands: Run with `bash`! 


```bash
$which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(bz2content);output_file.close();"
```

#### Cleanup Commands:
```bash
rm #{path_to_output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: Requires Python
##### Check Prereq Commands:
```bash
which_python=`which python`; $which_python -V
```
##### Get Prereq Commands:
```bash

```




<br/>
<br/>

## Atomic Test #3 - Compressing data using zipfile in Python (Linux)
Uses zipfile from Python to compress files

**Supported Platforms:** Linux


**auto_generated_guid:** 001a042b-859f-44d9-bf81-fd1c4e2200b0





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_input_file | Path to the file that you want to compress | Path | /etc/passwd|
| path_to_output_file | Path of the file that you want your .zip file to be | Path | /tmp/passwd.zip|


#### Attack Commands: Run with `bash`! 


```bash
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"
```

#### Cleanup Commands:
```bash
rm #{path_to_output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: Requires Python
##### Check Prereq Commands:
```bash
which_python=`which python`; $which_python -V
```
##### Get Prereq Commands:
```bash

```




<br/>
<br/>

## Atomic Test #4 - Compressing data using tarfile in Python (Linux)
Uses tarfile from Python to compress files

**Supported Platforms:** Linux


**auto_generated_guid:** e86f1b4b-fcc1-4a2a-ae10-b49da01458db





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_input_file | Path to the file that you want to compress | Path | /etc/passwd|
| path_to_output_file | Path of the file that you want your .tar.gz file to be | Path | /tmp/passwd.tar.gz|


#### Attack Commands: Run with `bash`! 


```bash
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"
```

#### Cleanup Commands:
```bash
rm #{path_to_output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: Requires Python
##### Check Prereq Commands:
```bash
which_python=`which python`; $which_python -V
```
##### Get Prereq Commands:
```bash

```




<br/>
