Linux Auditd: cat Command Appends ZIP Data to JPG/PNG

Alerts when cat is used to handle .jpg/.png with an associated .zip argument, consistent with hiding ZIP data in images.

FreeUnreviewedSigmalowv1

linux-auditd-cat-command-appends-zip-data-to-jpg-png-45810b50

title: "Linux Auditd: cat Command Appends ZIP Data to JPG/PNG"
id: 9ab86c6d-a642-4c12-abde-b47ca34e7eea
status: test
description: This rule flags execution of the cat command where the target file is identified as a .jpg or .png and an additional argument indicates a .zip extension. Appending or bundling ZIP content into an image is a common stealth technique to conceal secondary payloads or archives within seemingly benign files. It relies on Linux auditd telemetry capturing executed command-line arguments.
references:
  - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-09
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1027.003
logsource:
  product: linux
  service: auditd
detection:
  commands:
    type: EXECVE
    a0: cat
  a1:
    a1|endswith:
      - .jpg
      - .png
  a2:
    a2|endswith: .zip
  condition: commands and a1 and a2
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 45810b50-7edc-42ca-813b-bdac02fb946b
    type: derived

What it detects

This rule flags execution of the cat command where the target file is identified as a .jpg or .png and an additional argument indicates a .zip extension. Appending or bundling ZIP content into an image is a common stealth technique to conceal secondary payloads or archives within seemingly benign files. It relies on Linux auditd telemetry capturing executed command-line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.