huntrule

Linux auditd: unzip extraction from JPG/PNG files for hidden data

Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.

FreeUnreviewedSigmalowv1
title: "Linux auditd: unzip extraction from JPG/PNG files for hidden data"
id: 19b0b282-cb63-4a87-ae37-1f183449915b
status: test
description: This rule flags process executions where the command name is unzip and the relevant argument ends with .jpg or .png. Attackers may embed compressed payloads or data within image files and then extract them with unzip to blend concealment with normal user workflows. Telemetry relies on Linux auditd EXECVE records capturing the executed program and its trailing filename/argument extension.
references:
  - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-09
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1027.003
logsource:
  product: linux
  service: auditd
detection:
  commands:
    type: EXECVE
    a0: unzip
  a1:
    a1|endswith:
      - .jpg
      - .png
  condition: commands and a1
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: edd595d7-7895-4fa7-acb3-85a18a8772ca
    type: derived

What it detects

This rule flags process executions where the command name is unzip and the relevant argument ends with .jpg or .png. Attackers may embed compressed payloads or data within image files and then extract them with unzip to blend concealment with normal user workflows. Telemetry relies on Linux auditd EXECVE records capturing the executed program and its trailing filename/argument extension.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.