Linux auditd: Unzip files extracted from JPG/PNG images
Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the unzip utility where the command argument ends with .jpg or .png, indicating an attempt to extract embedded content from an image file. Such behavior can support stealthy staging by hiding archives within seemingly benign images. It relies on Linux auditd telemetry capturing process execution details, specifically the invoked command name and its arguments.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: Unzip files extracted from JPG/PNG images"
id: 19b0b282-cb63-4a87-ae37-1f183449915b
status: test
description: This rule flags execution of the unzip utility where the command argument ends with .jpg or .png, indicating an attempt to extract embedded content from an image file. Such behavior can support stealthy staging by hiding archives within seemingly benign images. It relies on Linux auditd telemetry capturing process execution details, specifically the invoked command name and its arguments.
references:
- https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-09
modified: 2022-10-09
tags:
- attack.stealth
- attack.t1027.003
logsource:
product: linux
service: auditd
detection:
commands:
type: EXECVE
a0: unzip
a1:
a1|endswith:
- .jpg
- .png
condition: commands and a1
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: edd595d7-7895-4fa7-acb3-85a18a8772ca
type: derived