Archive via Utility most typically occurs later in an attack, when an adversary has gathered sufficient data to warrant archiving the data prior to upload. Then, the "Automated Exfiltration" technique leverages some form of automation to conduct exfiltration activities, rather than rely on manually executed commands. As a primary data theft technique, T1020: Automated Exfiltration will typically occur after an adversary is in the position to act on objectives.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT41 (aka Double Dragon). Prevent adversaries from accomplishing the tactics of discovery and persistence.