Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule identifies executions of common compression tools on Linux: zip, gzip with the -k option, or tar with the -c option. Adversaries may compress collected documents to reduce size and improve portability ahead of exfiltration. The detection relies on auditd telemetry capturing execve events and the exact command-line arguments for these utilities.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Pivot detection · T1560.001 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-execution-of-zip-gzip-tar-for-data-compression-a3b5e3e9

title: "Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression"
id: dd11b2d0-7976-43d9-9126-3c78158712e2
status: test
description: "This rule identifies executions of common compression tools on Linux: zip, gzip with the -k option, or tar with the -c option. Adversaries may compress collected documents to reduce size and improve portability ahead of exfiltration. The detection relies on auditd telemetry capturing execve events and the exact command-line arguments for these utilities."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_data_compressed.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-07-28
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1560.001
logsource:
  product: linux
  service: auditd
detection:
  selection1:
    type: execve
    a0: zip
  selection2:
    type: execve
    a0: gzip
    a1: -k
  selection3:
    type: execve
    a0: tar
    a1|contains: -c
  condition: 1 of selection*
falsepositives:
  - Legitimate use of archiving tools by legitimate user.
level: low
license: DRL-1.1
related:
  - id: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL