Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. 

On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. 

Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Archive via Utility
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1560/001  external_id: T1560.001     source_name: WinRAR Homepage  description: A. Roshal. (2020). RARLAB. Retrieved February 20, 2020.  url: https://www.rarlab.com/     source_name: WinZip Homepage  description: Corel Corporation. (2020). WinZip. Retrieved February 20, 2020.  url: https://www.winzip.com/win/en/     source_name: 7zip Homepage  description: I. Pavlov. (2019). 7-Zip. Retrieved February 20, 2020.  url: https://www.7-zip.org/     source_name: diantz.exe_lolbas  description: Living Off The Land Binaries, Scripts and Libraries (LOLBAS). (n.d.). Diantz.exe. Retrieved October 25, 2021.  url: https://lolbas-project.github.io/lolbas/Binaries/Diantz/     source_name: Wikipedia File Header Signatures  description: Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.  url: https://en.wikipedia.org/wiki/List_of_file_signatures     