Sigma rule: Data Compressed

Rule

Title

Data Compressed

Status

test

Level

low

Author

Timur Zinniatullin, oscd.community

Date

2019-10-21

Modified

2023-07-28

File

rules/linux/auditd/execve/lnx_auditd_data_compressed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Log source

product

linux

service

auditd

Detection

selection1:
    type: 'execve'
    a0: 'zip'
selection2:
    type: 'execve'
    a0: 'gzip'
    a1: '-k'
selection3:
    type: 'execve'
    a0: 'tar'
    a1|contains: '-c'
condition: 1 of selection*

False positives (as the rule lists them)

• Legitimate use of archiving tools by legitimate user.

Tags

• attack.exfiltration
• attack.collection
• attack.t1560.001

MITRE ATT&CK ids this rule names

• T1560.001

References

• https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/execve/lnx_auditd_data_compressed.yml