ATT&CK T1022 - Encrypted Archive Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the exfiltration of encrypted archives over HTTP POST requests. It specifically looks for HTTP POST methods, the presence of file data, the 'PK' magic bytes indicating a ZIP or similar archive, and a file size greater than 50,000 bytes. This combination suggests an attempt to send a large, potentially encrypted, archive out of the network.