Archive Collected Data means bundling stolen files into a compressed or encrypted container before moving them out of a network. Attackers may use formats such as ZIP, RAR, 7z, or password-protected archives to shrink the payload, keep many files together, and make inspection harder. In threat modeling, this is a common step between collecting files and exfiltrating them.
This matters because archive creation is often a sign that an intrusion has progressed from simple access to active theft. Defenders look for spikes in file reads, unusual archive tools or command-line compression utilities, temporary staging directories, and outbound transfers that follow shortly after packaging. In incident response, detecting this behavior can help confirm data removal, estimate what was prepared for theft, and identify the systems used to stage the stolen material.