Attackers use Archive via Library to compress or package data with built-in archiving libraries before staging or exfiltration. That reduces transfer size and can bundle many files into one object for easier theft. Defenders should watch for archive creation on sensitive hosts, especially when it precedes network transfer or cloud upload.
Why Archive via Library matters to attackers
archive via library is a staging step, not just a compression trick. Attackers use built-in archiving functions to turn many files into one smaller object, which makes exfiltration faster, reduces the number of transfers they need, and can help them blend suspicious data movement into ordinary administrative activity. The technique is most concerning when it appears on systems that should not be assembling large outbound packages.
Because the archive is created before the data leaves the environment, the real security question is not only whether the files were copied, but whether the host was already preparing them for removal. That means defenders need to treat archive creation on sensitive endpoints as part of the exfiltration chain, especially when it is followed by cloud upload, remote transfer, or unusual egress patterns. For archive-and-stage behavior in the context of data theft, see Data Exfiltration Guide.
What makes this technique useful in real attack chains
Archive via Library is attractive because it lowers the friction of theft. Large collections of small files are harder to move one by one, easier to notice, and more likely to trip transfer limits or monitoring thresholds. Packaging them first can also make later transmission more reliable over slower links, cloud sync tooling, or application channels that would otherwise struggle with bulk file movement.
The technique is often paired with local staging. That gives the attacker time to collect material from multiple locations, compress it, and move only the final archive when the environment is quiet or when outbound access is available. In practice, the archive is part of the data handling workflow, so the key detection clue is the sequence of file collection, archive creation, and outbound transfer rather than any single event in isolation.
What defenders should look for before data leaves the host
Archive creation is especially suspicious when it occurs on servers, admin workstations, file shares, or other hosts that normally do not package large volumes of sensitive content. The strongest signals are not just the archive itself, but the surrounding context: access to high-value directories, repeated reads across many files, archive creation in temporary or staging paths, and a near-term network transfer or cloud upload from the same system.
Defenders should also consider whether the archive format or tool choice is unusual for the environment. A legitimate backup job or software deployment can look similar on the surface, but attacker staging often differs in timing, destination, naming, and frequency. If archive creation is followed by transfer to an unfamiliar external endpoint or cloud account, the event should be treated as possible data preparation for exfiltration, not routine file handling.
Risk and Threat Considerations
Archive creation can hide the scale of a theft operation by condensing many sensitive files into a single transferable object. That reduces the attacker’s exposure time, makes traffic easier to disguise, and can delay detection until after the archive has already left the environment.
Failure mechanism: The attacker gathers files, packages them with a built-in library, and moves the resulting archive through a channel that would have been noisier or less reliable for raw file transfer.
Impact: Sensitive data can be removed in fewer, harder-to-notice transfers, increasing the chance of successful exfiltration and reducing the window for containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1560 — Archive Collected Data | Covers attacker packaging of collected data before exfiltration. |
| T1020 — Data Exfiltration | The technique supports the exfiltration phase by reducing transfer overhead. | |
| Recommendation — Detect archive creation before outbound transfer and hunt for staging behavior. Correlate archive activity with network egress and cloud upload paths. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | File and transfer events need logging to spot staging and exfiltration prep. |
| Recommendation — Centralize host and cloud logs so archive-and-transfer sequences are observable. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Unexpected archive creation and transfer are anomaly signals worth monitoring. |
| Recommendation — Monitor for unusual archive creation on sensitive hosts and investigate linked egress. | ||
Practitioner Guidance
What to verify: Correlate archive creation with prior file access, process lineage, and outbound transfer. If a host that does not normally package bulk data suddenly creates archives and then makes a network or cloud connection, treat that as a single investigative thread rather than isolated alerts.
What practitioners underestimate: The archive itself is often the last visible step before loss, so waiting for obvious outbound spikes can be too late. The more useful control point is the preparation phase, where collection and packaging reveal intent before the transfer completes.
Practitioner takeaway: The most reliable detection comes from sequence, not a lone event: file gathering, archive creation, and outbound movement should be reviewed together whenever sensitive systems produce unexpected packaged data.