Linux auditd: cat appends ZIP data to image files
Alerts when cat is used to handle .jpg/.png with an associated .zip argument, consistent with hiding ZIP data in images.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the cat utility where the command arguments include an image file name ending in .jpg or .png and a second argument ending in .zip. Appending ZIP content to an image is a common steganography-like concealment technique that can hide compressed payloads in seemingly benign files. It relies on Linux auditd EXECVE command-line telemetry to identify the involved filenames by their extensions.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: cat appends ZIP data to image files"
id: 9ab86c6d-a642-4c12-abde-b47ca34e7eea
status: test
description: This rule flags execution of the cat utility where the command arguments include an image file name ending in .jpg or .png and a second argument ending in .zip. Appending ZIP content to an image is a common steganography-like concealment technique that can hide compressed payloads in seemingly benign files. It relies on Linux auditd EXECVE command-line telemetry to identify the involved filenames by their extensions.
references:
- https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-09
modified: 2022-10-09
tags:
- attack.stealth
- attack.t1027.003
logsource:
product: linux
service: auditd
detection:
commands:
type: EXECVE
a0: cat
a1:
a1|endswith:
- .jpg
- .png
a2:
a2|endswith: .zip
condition: commands and a1 and a2
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 45810b50-7edc-42ca-813b-bdac02fb946b
type: derived