Possible Data Compressed (via auditd)

title: Possible Data Compressed (via auditd)
id: e239aa0c-4077-5310-9197-7a328d45b83e
status: stable
description: This rule detects an adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration to make it portable and minimize the amount of data sent over the network.
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
author: Huntrule Team
date: 2026-01-07
tags:
    - attack.exfiltration
    - attack.collection
    - attack.t1560.001
logsource:
    product: linux
    service: auditd
detection:
    selection1:
        type: 'execve'
        a0: 'zip'
    selection2:
        type: 'execve'
        a0: 'gzip'
        a1: '-k'
    selection3:
        type: 'execve'
        a0: 'tar'
        a1|contains: '-c'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: low