Archive via Library is the creation of compressed archives using a system or application library rather than an obvious archiving utility. Attackers use it to stage files for theft or reduce their visibility to basic controls. Defenders should look for archive creation by unusual processes, especially before exfiltration or cleanup.
How Archive via Library Works
Archive via Library is a technique for creating compressed archives through a normal system or application library instead of a visible archiving utility. That distinction matters because the file bundle is still an archive, but the process that produces it may look less suspicious to basic monitoring.
In practice, the attacker is often using the same capability a legitimate application would use to compress content, package data, or prepare attachments. The technique becomes noteworthy when the archive contains collected files, staged data, or material being prepared for transfer, because the library call can blend into ordinary application behaviour.
Why Attackers Use It
The main value of archive via library is concealment through routine-looking execution. Security tools that focus on obvious shell commands or known archiving binaries may miss the event if the archive is produced by a less conspicuous process, such as a browser helper, scripting host, line-of-business app, or other expected software component.
It is also useful for data staging and exfiltration patterns, where the archive becomes a transport package for later movement out of the environment. Compressing files can reduce volume, consolidate many items into one object, and make subsequent theft or cleanup easier.
How Defenders Detect It
Detection depends on comparing the process creating the archive with what that process normally does. Archive creation by an unusual parent process, at an unusual time, or in a workflow that does not normally handle file packaging is often more important than the archive file itself.
Useful signals include archive creation shortly before egress, remote transfer, deletion of source files, or other staging behaviour. Review process lineage, command-line context, file write events, and any preceding collection activity so the archive is interpreted as part of a chain rather than as an isolated file operation.
It is also helpful to correlate archive creation with broader exfiltration telemetry such as unusual network destinations, cloud storage uploads, or repeated access to sensitive directories. The archive may be only one step in a larger collection-and-transfer sequence.
What It Means for Response and Hardening
When archive via library is suspected, the response should focus on the process that created the archive, the files that were included, and any subsequent transfer or cleanup activity. If the archive was part of a compromise, preserve the file, the parent process details, and surrounding telemetry so the data path can be reconstructed.
From a hardening perspective, organisations benefit from baselining which applications legitimately create archives and where those archives are normally written. That makes it easier to spot suspicious packaging of sensitive files and to distinguish routine compression from preparatory exfiltration. Monitoring for adversary staging and collection behaviour in MITRE ATT&CK helps place the technique in a broader intrusion chain.
Risk and Threat Considerations
Archive via library increases the chance that collection activity blends into ordinary application behaviour, which can delay detection and give an attacker more time to stage or remove sensitive material. The main security concern is not compression itself, but the way it can hide preparatory activity before exfiltration or cleanup.
Failure mechanism: Security monitoring often keys on known archiving utilities, obvious command lines, or expected file-management workflows, so library-driven archive creation can evade simplistic detections unless defenders inspect process ancestry and file activity together.
Impact: Sensitive files may be bundled, staged, and moved with less scrutiny, increasing the likelihood of data theft, evidence removal, or broader compromise before defenders notice the activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0009 — Collection | Archive via library is a collection and staging technique in an intrusion chain. |
| TA0010 — Exfiltration | The archive is commonly created to support later data theft and transfer. | |
| Recommendation — Map archive creation by unusual processes to collection activity and correlate it with staging before exfiltration. Hunt for archive creation that precedes unusual outbound transfer or cloud upload paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor Networks and Systems for Anomalous Activity | Unexpected archive creation by odd processes is an anomalous endpoint activity to monitor. |
| DE.AE-02 — Analyze Events to Understand Threats | Archive creation becomes meaningful when analyzed as part of a broader attack sequence. | |
| Recommendation — Baseline normal archiving behaviour and alert on archive creation by unexpected processes. Correlate archive events with file access, transfer, and cleanup to determine whether they form an intrusion pattern. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Audit telemetry is needed to see which process created an archive and when. |
| Recommendation — Retain process and file-activity logs needed to reconstruct suspicious archive creation. | ||