Attackers use Archive via Custom Method to bundle files in a way that helps them hide, move, or stage stolen data before exfiltration. They may choose uncommon tooling or naming to evade detection. Defenders should inspect archive creation on sensitive hosts, monitor large or unusual compression activity, and flag archives that appear in unexpected locations.
What attackers gain by archiving stolen data with a custom method
Attackers use archive creation to compress, package, and delay inspection of stolen files before exfiltration. A custom method can make the archive look less familiar to detection rules, preserve a bundle of many files as one object, and help stage data for later movement. The technique is most useful when the attacker already has access to sensitive files and wants to reduce noise.
Because the archive is often created on the source host, the key question is not only whether compression happened, but whether it happened on a system that should not be preparing outbound data. On sensitive hosts, archive activity can be an early sign of collection and staging rather than an ordinary administrative task.
What makes custom archiving harder to spot
Custom archiving is usually less about the compression algorithm itself and more about the attacker’s operational choices. They may use uncommon tooling, nonstandard file names, unusual extensions, or a less typical sequence of file access, compression, and transfer so that the archive creation blends into normal activity. That can reduce the chance that a defender sees a recognizable utility or a predictable output path.
That is why defenders should look beyond the archive file alone and examine the surrounding behavior. Large bursts of file reads, a sudden archive written to an unusual directory, or archive creation followed quickly by outbound transfer are stronger indicators than the filename by itself.
For a broader view of how attackers package and move stolen information, the Data Exfiltration Guide covers data staging, archive-based collection, and common exfiltration patterns. When archive creation appears in the context of preparation for outbound transfer, it should be treated as part of the exfiltration chain, not as an isolated file operation.
How defenders should investigate archive creation activity
The most useful investigation starts with context: which host created the archive, which user or process did it, what files were included, where the archive was written, and whether the host normally performs that task. On endpoints that should not be packaging large amounts of data, even a legitimate archive utility can be suspicious if the timing and destination are unusual.
Practical review points include:
- Archive creation on servers that do not normally compress data for business reasons.
- Large or unusual compression jobs outside standard maintenance windows.
- Archives created in temporary, hidden, or unexpected directories.
- Archive names that do not match the surrounding system conventions.
- Archive creation followed by immediate copy, sync, upload, or network transfer activity.
When the archive includes sensitive content, the defender should also consider whether the event represents collection rather than exfiltration itself. That distinction matters because the earliest safe intervention point is often when the data is still on the local host and before it has been staged for outbound movement.
Risk and Threat Considerations
Archive creation becomes risky when it is used as a staging step for stolen data, because the bundle can conceal the scope of the loss and make later transfer easier. The threat is not the compression action alone, but the combination of data access, packaging, and outbound movement that can hide under routine file activity.
Failure mechanism: An attacker compresses or bundles sensitive files on a compromised host, uses an unusual method or naming pattern to blend in, and then moves the archive out through a channel that is harder to inspect.
Impact: Defenders may see only a normal-looking archive event while the real loss is already in motion, which can delay detection, widen the exfiltration window, and increase the amount of data taken before containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1560 — Archive Collected Data | Archive creation is the core staging behavior described in this exfiltration technique. |
| T1020 — Data Exfiltration | The subject is attacker packaging of stolen data for later removal from the environment. | |
| Recommendation — Map archive-creation events to T1560 and hunt for packaging before outbound transfer. Correlate archive creation with transfer activity to confirm exfiltration intent. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Archive staging is best found by reviewing endpoint and file activity telemetry. |
| Recommendation — Review file and process audit data for unusual archive creation on sensitive hosts. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection depends on collecting logs for file creation, process execution, and transfer. |
| Recommendation — Centralize logs that show archive creation and follow-on data movement. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Ongoing monitoring is needed to spot abnormal compression and staging activity. |
| Recommendation — Monitor for abnormal archive creation on hosts that handle sensitive data. | ||
Practitioner Guidance
What to verify: Confirm whether the host, user, and process are expected to create archives at all, then compare the archive location, size, and timing against normal behavior. If the archive was written on a sensitive system, check what files were included and whether they map to a data set that should have been accessed together.
Decision rule: If archive creation is paired with unusual source-file access or a subsequent transfer, treat it as a staging event and investigate immediately, even if the compression utility itself is familiar. If the archive is isolated and clearly part of a known operational workflow, document the baseline so future deviations are easier to spot.
Practitioner takeaway: The important judgment is to evaluate archive creation as part of an access-and-staging sequence, not as a standalone file event; the surrounding process behavior usually matters more than the archive format.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org