Archive via Utility is the use of built-in or trusted archiving tools to package files before exfiltration or staging. Attackers do this to compress data, reduce transfer size, and blend in with normal administration, so defenders should monitor unusual archive creation, archive locations, and large outbound transfers from endpoints.
How archive via utility works
Archive via Utility is not a special file format, but a staging behaviour. An attacker uses ordinary archiving software or built-in compression features to gather files into one container before moving them, which makes the payload easier to handle and often less conspicuous than many loose files.
This matters because the archive step changes the shape of the data, not the content alone. A small number of compressed files can conceal a much larger collection of documents, logs, scripts, or credentials, and a defender may only see the archive activity if they are watching endpoint tooling, file creation patterns, and the timing of subsequent transfer.
Why attackers use trusted archiving tools
Abusing a trusted utility helps the activity blend into normal administrative work. Archive creation is common on user endpoints, servers, and developer systems, so the behaviour can look like routine housekeeping unless it is unusual in volume, location, or sequence. The technique also reduces transfer size, which can help with slower links, quota limits, or noisy exfiltration paths.
Archive creation becomes especially useful when paired with data exfiltration tradecraft, because staged content can be moved later through web services, cloud storage, removable media, or other outbound channels with less friction.
What defenders should look for
Monitoring should focus on deviations from normal user or system behaviour, not archive use in isolation. Suspicious signals include archives created in temporary folders, user profile paths, shared staging locations, or alongside bulk file collection; archives produced shortly before large outbound transfers; and archiving activity that does not match the role of the host or account.
Defenders should also correlate archive creation with network egress, file access bursts, and unusual process ancestry. When archive activity is followed by outbound transfer, the combined pattern is often more meaningful than any single event.
Security implications of archive staging
Archive staging can hide the scope of collection and delay detection until the transfer phase. It can also complicate forensics, because investigators may first see a compact container rather than the original breadth of files that were gathered, copied, or prepared for export.
Compression can be a practical advantage for the attacker even when the archive is not encrypted. It lowers the apparent volume of suspicious activity, can bypass some crude size-based controls, and may help the operator move data over channels that would otherwise be too slow or too noisy for direct copying.
Risk and Threat Considerations
Archive via Utility is risky because it compresses and packages stolen or staged data into a form that is easier to move, hide, and re-use. The same behaviour can support pre-exfiltration staging, post-compromise collection, and rapid transfer to external destinations.
Failure mechanism: defenders miss the archive-creation step or treat it as benign administration, so the attacker can aggregate large amounts of data before the outbound transfer becomes visible.
Impact: collection can scale quietly, dwell time can increase, and the eventual exfiltration event can involve a much larger and more damaging payload than the initial host activity suggested.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1560 — Archive Collected Data | Covers attacker use of archives to stage or move collected data |
| Recommendation — Map archive-creation events to T1560 and alert on archive staging before outbound transfer. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and services are monitored to detect potential cybersecurity events | Archive staging is detectable through monitoring of endpoint and egress activity |
| Recommendation — Monitor archive creation and correlate it with unusual outbound transfers. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Archive staging becomes visible through endpoint and transfer logging |
| Recommendation — Log archive creation and related file transfer activity for investigation and correlation. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Archive and transfer events need audit records to support detection and forensics |
| SI-4 — System Monitoring | Archive staging is a monitored endpoint behaviour that can indicate compromise | |
| Recommendation — Generate audit records for archive creation, file access bursts, and outbound transfer events. Use system monitoring to flag unusual archive creation in staging paths before exfiltration. | ||
Practitioner Guidance
What to watch for: treat archive activity as suspicious when it is atypical for the user, host, or time of day, especially when it appears in staging directories or precedes large outbound transfers. File creation patterns, command-line usage, and parent-child process relationships often provide the clearest context.
Governance implication: archive usage is not inherently malicious, so teams need a baseline for legitimate compression workflows and a separate review path for unusual archive creation linked to data movement. That distinction helps reduce false positives without losing visibility into staging behaviour.
Related resources from NHI Mgmt Group
- How should security teams control vendor access in water utility OT environments?
- How should utility companies centralize authorization without breaking operations?
- When does DNS become a security control rather than an infrastructure utility?
- How can security teams tell whether identity governance is working in a utility?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org