Linux Auditd: Execution of Zip, Gzip, Tar for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

FreeUnreviewedSigmalowv1

linux-auditd-execution-of-zip-gzip-tar-for-data-compression-a3b5e3e9

title: "Linux Auditd: Execution of Zip, Gzip, Tar for Data Compression"
id: dd11b2d0-7976-43d9-9126-3c78158712e2
status: test
description: "This rule flags Linux auditd events where an executable process for common archive/compression tools is launched: zip, gzip (-k), or tar with a create flag. Adversaries may compress collected data to reduce size and improve portability prior to exfiltration, increasing the chance of successful data transfer. The detection relies on auditd telemetry capturing execve process creation and matching tool names and command-line patterns."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_data_compressed.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-07-28
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1560.001
logsource:
  product: linux
  service: auditd
detection:
  selection1:
    type: execve
    a0: zip
  selection2:
    type: execve
    a0: gzip
    a1: -k
  selection3:
    type: execve
    a0: tar
    a1|contains: -c
  condition: 1 of selection*
falsepositives:
  - Legitimate use of archiving tools by legitimate user.
level: low
license: DRL-1.1
related:
  - id: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee
    type: derived

What it detects

This rule flags Linux auditd events where an executable process for common archive/compression tools is launched: zip, gzip (-k), or tar with a create flag. Adversaries may compress collected data to reduce size and improve portability prior to exfiltration, increasing the chance of successful data transfer. The detection relies on auditd telemetry capturing execve process creation and matching tool names and command-line patterns.

Known false positives

Legitimate use of archiving tools by legitimate user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.