attack_technique: T1560.001
display_name: 'Archive Collected Data: Archive via Utility'
atomic_tests:
- name: Compress Data for Exfiltration With Rar
  auto_generated_guid: 02ea31cb-3b4c-4a2d-9bf1-e4e70ebcf5d0
  description: |
    An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
    When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory 
  supported_platforms:
    - windows
  input_arguments:
    input_path:
      description: Path that should be compressed into our output file
      type: Path
      default: '%USERPROFILE%'
    file_extension:
      description: Extension of files to compress
      type: String
      default: ".txt"
    output_file:
      description: Path where resulting compressed data should be placed
      type: Path
      default: '%USERPROFILE%\T1560.001-data.rar'
    rar_installer:
      description: Winrar installer
      type: Path
      default: '%TEMP%\winrar.exe'
    rar_exe:
      description: The RAR executable from Winrar
      type: Path
      default: '%programfiles%/WinRAR/Rar.exe'
  dependencies:
    - description: |
        Rar tool must be installed at specified location (#{rar_exe})
      prereq_command: |
        if not exist "#{rar_exe}" (exit /b 1)
      get_prereq_command: |
        echo Downloading Winrar installer
        bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
        #{rar_installer} /S
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      "#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}
    cleanup_command: |
      del /f /q /s #{output_file} >nul 2>&1
- name: Compress Data and lock with password for Exfiltration with winrar
  auto_generated_guid: 8dd61a55-44c6-43cc-af0c-8bdda276860c
  description: |
    Note: Requires winrar installation
    rar a -p"blue" hello.rar (VARIANT)
  supported_platforms:
    - windows
  input_arguments:
    rar_installer:
      description: Winrar installer
      type: Path
      default: '%TEMP%\winrar.exe'
    rar_exe:
      description: The RAR executable from Winrar
      type: Path
      default: '%programfiles%/WinRAR/Rar.exe'
  dependencies:
  - description: |
      Rar tool must be installed at specified location (#{rar_exe})
    prereq_command: |
      if not exist "#{rar_exe}" (exit /b 1)
    get_prereq_command: |
      echo Downloading Winrar installer
      bitsadmin /transfer myDownloadJob /download /priority normal "https://www.win-rar.com/fileadmin/winrar-versions/winrar/th/winrar-x64-580.exe" #{rar_installer}
      #{rar_installer} /S
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      mkdir .\tmp\victim-files
      cd .\tmp\victim-files
      echo "This file will be encrypted" > .\encrypted_file.txt
      "#{rar_exe}" a -hp"blue" hello.rar
      dir
- name: Compress Data and lock with password for Exfiltration with winzip
  auto_generated_guid: 01df0353-d531-408d-a0c5-3161bf822134
  description: |
    Note: Requires winzip installation
    wzzip sample.zip -s"blueblue" *.txt (VARIANT)
  supported_platforms:
    - windows
  input_arguments:
    winzip_exe:
      description: Path to installed Winzip executable
      type: Path
      default: "%ProgramFiles%\\WinZip\\winzip64.exe"
    winzip_url:
      description: Path to download Windows Credential Editor zip file
      type: Url
      default: https://download.winzip.com/gl/nkln/winzip24-home.exe
    winzip_hash:
      description: File hash of the Windows Credential Editor zip file
      type: String
      default: B59DB592B924E963C21DA8709417AC0504F6158CFCB12FE5536F4A0E0D57D7FB
  dependency_executor_name: powershell
  dependencies:
    - description: |
        Winzip must be installed
      prereq_command: |
        cmd /c 'if not exist "#{winzip_exe}" (echo 1) else (echo 0)'
      get_prereq_command: |
        if(Invoke-WebRequestVerifyHash "#{winzip_url}" "$env:Temp\winzip.exe" #{winzip_hash}){
          Write-Host Follow the installation prompts to continue
          cmd /c "$env:Temp\winzip.exe"
        }
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      path=%path%;"C:\Program Files (x86)\winzip"
      mkdir .\tmp\victim-files
      cd .\tmp\victim-files
      echo "This file will be encrypted" > .\encrypted_file.txt
      "#{winzip_exe}" -min -a -s"hello" archive.zip *
      dir
- name: Compress Data and lock with password for Exfiltration with 7zip
  auto_generated_guid: d1334303-59cb-4a03-8313-b3e24d02c198
  description: |
    Note: Requires 7zip installation
  supported_platforms:
    - windows
  input_arguments:
    7zip_installer:
      description: 7zip installer
      type: Path
      default: "%TEMP%\\7zip.exe"  
    7zip_exe:
      description: Path to installed 7zip executable
      type: Path
      default: "%ProgramFiles%\\7-zip\\7z.exe"
  dependencies:
  - description: |
      7zip tool must be installed at specified location (#{7zip_exe})
    prereq_command: |
      if not exist "#{7zip_exe}" (exit /b 1)
    get_prereq_command: |
      echo Downloading 7-zip installer
      bitsadmin /transfer myDownloadJob /download /priority normal "https://www.7-zip.org/a/7z2002-x64.exe" #{7zip_installer}
      #{7zip_installer} /S
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      mkdir $PathToAtomicsFolder\T1560.001\victim-files
      cd $PathToAtomicsFolder\T1560.001\victim-files
      echo "This file will be encrypted" > .\encrypted_file.txt
      "#{7zip_exe}" u archive.7z *txt -pblue
      dir
- name: Data Compressed - nix - zip
  auto_generated_guid: c51cec55-28dd-4ad2-9461-1eacbc82c3a0
  description: |
    An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.
  supported_platforms:
    - linux
    - macos
  input_arguments:
    input_files:
      description: Path that should be compressed into our output file, may include wildcards
      type: Path
      default: /var/log/{w,b}tmp
    output_file:
      description: Path that should be output as a zip archive
      type: Path
      default: $HOME/data.zip
  dependencies:
    - description: |
        Files to zip must exist (#{input_files})
      prereq_command: |
        if [ $(ls #{input_files} | wc -l) > 0 ] && [ -x $(which zip) ] ; then exit 0; else exit 1; fi;
      get_prereq_command: |
        (which yum && yum -y epel-release zip)||(which apt-get && apt-get install -y zip)
        echo Please set input_files argument to include files that exist
  executor:
    name: sh
    elevation_required: false
    command: |
      zip #{output_file} #{input_files}
    cleanup_command: |
      rm -f #{output_file}
- name: Data Compressed - nix - gzip Single File
  auto_generated_guid: cde3c2af-3485-49eb-9c1f-0ed60e9cc0af
  description: |
    An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
  supported_platforms:
    - linux
    - macos
  input_arguments:
    input_file:
      description: Path that should be compressed
      type: Path
      default: $HOME/victim-gzip.txt
    input_content:
      description: contents of compressed files if file does not already exist. default contains test credit card and social security number
      type: String
      default: 'confidential! SSN: 078-05-1120 - CCN: 4000 1234 5678 9101'
  executor:
    name: sh
    elevation_required: false
    command: |
      test -e #{input_file} && gzip -k #{input_file} || (echo '#{input_content}' >> #{input_file}; gzip -k #{input_file})
    cleanup_command: |
      rm -f #{input_file}.gz
- name: Data Compressed - nix - tar Folder or File
  auto_generated_guid: 7af2b51e-ad1c-498c-aca8-d3290c19535a
  description: |
    An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
  supported_platforms:
    - linux
    - macos
  input_arguments:
    input_file_folder:
      description: Path that should be compressed
      type: Path
      default: '$HOME/$USERNAME'
    output_file:
      description: File that should be output
      type: Path
      default: '$HOME/data.tar.gz'
  dependencies:
    - description: |
        Folder to zip must exist (#{input_file_folder})
      prereq_command: |
        test -e #{input_file_folder}
      get_prereq_command: |
        echo Please set input_file_folder argument to a folder that exists
  executor:
    name: sh
    elevation_required: false
    command: |
      tar -cvzf #{output_file} #{input_file_folder}
    cleanup_command: |
      rm -f #{output_file}
- name: Data Encrypted with zip and gpg symmetric
  auto_generated_guid: 0286eb44-e7ce-41a0-b109-3da516e05a5f
  description: |
    Encrypt data for exiltration
  supported_platforms:
    - macos
    - linux
  input_arguments:
    test_folder:
      description: Path used to store files.
      type: Path
      default: /tmp/T1560
    test_file:
      description: Temp file used to store encrypted data.
      type: Path
      default: T1560
    encryption_password:
      description: Password used to encrypt data.
      type: String
      default: InsertPasswordHere
  dependency_executor_name: sh
  dependencies:
    - description: gpg and zip are required to run the test.
      prereq_command: |
        if [ ! -x "$(command -v gpg)" ] || [ ! -x "$(command -v zip)" ]; then exit 1; fi;
      get_prereq_command: |
        (which yum && yum -y epel-release zip gpg)||(which apt-get && apt-get install -y zip gpg)
  executor:
    name: sh
    elevation_required: false
    command: |
      mkdir -p #{test_folder}
      cd #{test_folder}; touch a b c d e f g
      zip --password "#{encryption_password}" #{test_folder}/#{test_file} ./*
      echo "#{encryption_password}" | gpg --batch --yes --passphrase-fd 0 --output #{test_folder}/#{test_file}.zip.gpg -c #{test_folder}/#{test_file}.zip
      ls -l #{test_folder}
    cleanup_command: |
      rm -Rf #{test_folder}
