Preparation
Account Creation
Account Discovery
AI-Assisted Capability Development
Archive Data
Authorization Token Staging
Boot Order Manipulation
CCTV Enumeration
Circumventing Security Controls
- Bypassing Network Segmentation
- Downgrading Microsoft Information Protection (MIP) labels
- Impairing a Security Agent
- Impairing an Anti-Virus Solution
- Modifying a Cloud-Based Firewall
- Modifying a Host-Based Firewall
- Modifying a Network-Based Firewall
- Unauthorized Manipulation of Anti-Virus Exclusions
- Uninstalling a Security Agent
- Uninstalling an Anti-Virus Solution
Credential Collection
Data Deobfuscation
Data Obfuscation
Data Staging
Delegated Preparation via Artificial Intelligence Agents
Device Mounting
Email Collection
External Media Formatting
File Download
File Exploration
Hardware-Based Remote Access (IP-KVM)
Impersonation
IT Ticketing System Exploration
Joiner
Lateral Movement
Media Capture via External Device
Mover
Network Scanning
Observational Information Gathering
On-Screen Data Collection
Oversight Circumvention and Control Degradation
Persistent Access via Bots
Physical Disk Removal
Physical Exploration
Physical Item Smuggling
Private / Incognito Browsing
Privilege Elevation
Read Windows Registry
Remote Desktop (RDP)
Security Software Enumeration
Social Engineering (Outbound)
Software Installation
- Installation of Dark Web-Capable Browsers
- Installing Browser Extensions
- Installing Browsers
- Installing Cloud Storage Applications
- Installing FTP Clients
- Installing Messenger Applications
- Installing Note-Taking Applications
- Installing RDP Clients
- Installing Screen Sharing Software
- Installing SSH Clients
- Installing Virtual Machines
- Installing VPN Applications
Software or Access Request
Suspicious Web Browsing
System Persistence
System Profiling
Testing Ability to Print
Testing Security Controls
Unauthorized Hardware Introduction
VPN Usage
- ID: PR017
- Created: 31st May 2024
- Updated: 23rd October 2025
- Platforms: WindowsLinuxMacOS
- MITRE ATT&CK®: T1560T1560.001T1560.002T1560.003
- Contributor: The ITM Team
Archive Data
A subject uses utilities to compress and/or encrypt collected data prior to exfiltration.
Subsections (4)
| ID | Name | Description |
|---|---|---|
| PR017.003 | Archive via Compression | A subject uses utilities to compress collected data prior to exfiltration. |
| PR017.004 | Archive via Encryption | A subject uses utilities to encrypt collected data prior to exfiltration. |
| PR017.002 | Archive via Library | A subject uses utilities to compress and/or encrypt collected data prior to exfiltration. |
| PR017.001 | Archive via Utility | A subject uses utilities to compress and/or encrypt collected data prior to exfiltration. |
Preventions (2)
Detections (1)
MITRE ATT&CK® Mapping (4)
ATT&CK Enterprise Matrix Version 19.1