Archive utility run against a Linux staging directory

Siemphony@siemphonylowT1027.015unverified

AN0783 describes a compression utility run against a scratch location and then the unpacked file being executed shortly afterwards. Only the first half of that is a single event, so this rule matches it alone: one of the command-line archivers, with a staging path anywhere in its arguments. The tool list is MITRE's `CompressionToolPatterns` knob, populated here with the tar, gzip, bzip2, xz, zstd, zip, rar, 7-Zip and cpio families rather than taken from MITRE; the path list is MITRE's `PathRegex` knob, which names /tmp, /dev/shm and the user's home directory — the first two are used, and the home directory is left out because a `/home/` substring matches nearly every command line typed on a workstation and would make the rule fire on itself. Both terms are written without a trailing slash on purpose: the destination is at least as often given as a bare directory argument — `tar -C /tmp -xf pkg.tgz`, `unzip -d /tmp pkg.zip`, `7z x -o/tmp` — as it is as a full path to a file, and a `/tmp/` term with the slash matches only the second of those, which would have made the gate look tighter than it is while quietly dropping the common extraction form. `/var/tmp` needs no separate entry, since it contains `/tmp`. The direction is deliberately not constrained: the same selection catches an archive being unpacked into the staging directory and one being built there. Only the first of those is AN0783's observable — the analytic describes a compression utility followed by execution of the unpacked file — so the archive-creation half is authored scope rather than MITRE's, and on that half the rule overlaps the collection technique T1560.001 rather than this one. The tools that only ever decompress (gunzip, bunzip2, unxz, unzstd, unzip, unrar, zcat) are the arm grounded in the analytic; tar, zip, rar, cpio and the 7-Zip family match in both directions, because separating them needs a verb list and a wrong verb term would silently kill the selection instead. What this cannot see is the larger half of the technique. Unpacking done inside a compiled dropper, or by a script using a language runtime's own archive library — Python's zipfile, Perl's Archive::Tar, a Go program with archive/zip — execs no archiver and produces no match, and shellcode compressed into a registry value or a config blob never touches a filesystem archiver at all. MITRE's `ExecutionAfterUnpackWindow` knob, which is what would make this rule specific, is a cross-event correlation between the unpack and a later execve, and lib/sigma models neither a timeframe nor a join. Note also that on p7zip the `7z` in the path is a shell wrapper, so the exec that matches here is the second one, of the real binary under /usr/lib/p7zip — which still ends in `/7z`, but the wrapper invocation itself appears as a shell. Two arms of DET0281 are not attempted. AN0784 (macOS) offers only `macos:unifiedlog`, which has no standardised Sigma field vocabulary, so ditto, xar and pkgutil would have to be written against invented field names. AN0782 (Windows) is skipped for a different reason: its observable is archiving utilities run with an archive verb on `process_creation/windows`, and that selection is already published in this corpus under T1560.001, so re-authoring it here would add a second copy of the same logic rather than new coverage. Vocabulary and prerequisite: this rule is written in the Sysmon-for-Linux shaped `process_creation` vocabulary (Image, CommandLine) that the brief maps `auditd:SYSCALL::execve` onto. Raw auditd carries the same values as `exe=` on the SYSCALL record and `a0`..`aN` on a separate EXECVE record, so that feed needs a field mapping first, and auditd records no execve until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded. Until one is, this rule returns zero rows, and zero rows here means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0281, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/tar" or FolderPath endswith "/bsdtar" or FolderPath endswith "/gzip" or FolderPath endswith "/gunzip" or FolderPath endswith "/zcat" or FolderPath endswith "/bzip2" or FolderPath endswith "/bunzip2" or FolderPath endswith "/xz" or FolderPath endswith "/unxz" or FolderPath endswith "/lzma" or FolderPath endswith "/zstd" or FolderPath endswith "/unzstd" or FolderPath endswith "/zip" or FolderPath endswith "/unzip" or FolderPath endswith "/rar" or FolderPath endswith "/unrar" or FolderPath endswith "/7z" or FolderPath endswith "/7za" or FolderPath endswith "/7zr" or FolderPath endswith "/7zz" or FolderPath endswith "/cpio") and (ProcessCommandLine contains "/tmp" or ProcessCommandLine contains "/dev/shm"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/tar" OR Image="*/bsdtar" OR Image="*/gzip" OR Image="*/gunzip" OR Image="*/zcat" OR Image="*/bzip2" OR Image="*/bunzip2" OR Image="*/xz" OR Image="*/unxz" OR Image="*/lzma" OR Image="*/zstd" OR Image="*/unzstd" OR Image="*/zip" OR Image="*/unzip" OR Image="*/rar" OR Image="*/unrar" OR Image="*/7z" OR Image="*/7za" OR Image="*/7zr" OR Image="*/7zz" OR Image="*/cpio") AND (CommandLine="*/tmp*" OR CommandLine="*/dev/shm*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/tar" OR TO_LOWER(process.executable) LIKE "*/bsdtar" OR TO_LOWER(process.executable) LIKE "*/gzip" OR TO_LOWER(process.executable) LIKE "*/gunzip" OR TO_LOWER(process.executable) LIKE "*/zcat" OR TO_LOWER(process.executable) LIKE "*/bzip2" OR TO_LOWER(process.executable) LIKE "*/bunzip2" OR TO_LOWER(process.executable) LIKE "*/xz" OR TO_LOWER(process.executable) LIKE "*/unxz" OR TO_LOWER(process.executable) LIKE "*/lzma" OR TO_LOWER(process.executable) LIKE "*/zstd" OR TO_LOWER(process.executable) LIKE "*/unzstd" OR TO_LOWER(process.executable) LIKE "*/zip" OR TO_LOWER(process.executable) LIKE "*/unzip" OR TO_LOWER(process.executable) LIKE "*/rar" OR TO_LOWER(process.executable) LIKE "*/unrar" OR TO_LOWER(process.executable) LIKE "*/7z" OR TO_LOWER(process.executable) LIKE "*/7za" OR TO_LOWER(process.executable) LIKE "*/7zr" OR TO_LOWER(process.executable) LIKE "*/7zz" OR TO_LOWER(process.executable) LIKE "*/cpio") AND (TO_LOWER(process.command_line) LIKE "*/tmp*" OR TO_LOWER(process.command_line) LIKE "*/dev/shm*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/tar$|/bsdtar$|/gzip$|/gunzip$|/zcat$|/bzip2$|/bunzip2$|/xz$|/unxz$|/lzma$|/zstd$|/unzstd$|/zip$|/unzip$|/rar$|/unrar$|/7z$|/7za$|/7zr$|/7zz$|/cpio$)</field>    <field name="CommandLine" type="pcre2">(?i)(/tmp|/dev/shm)</field>    <description>Archive utility run against a Linux staging directory</description>    <mitre>      <id>T1027.015</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2f09cb2d-5428-4cb0-93ef-b9d946a569b6

ATT&CKT1027.015

T1027.015Compression

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

AN0783 describes a compression utility run against a scratch location, followed shortly by execution of the unpacked file. Only the first half is a single event, so the rule matches that alone: a command-line archiver with a staging path somewhere in its arguments. The follow-on execution is MITRE's ExecutionAfterUnpackWindow knob — a cross-event correlation, and lib/sigma models neither a timeframe nor a join. Know which half of your hits is the technique. Only the decompress-only tools (gunzip, bunzip2, unxz, unzstd, unzip, unrar, zcat) are unambiguously this. tar, zip, rar, cpio, bsdtar and the 7-Zip family match an archive being built in /tmp just as readily, and that is collection-then-exfil behaviour — T1560.001 or T1074.001, not obfuscation. The selection is direction-blind by design, because separating the two needs a verb list and a wrong verb term would kill the selection silently.

02 · Telemetry you need

category: process_creation / product: linux, verbatim from AN0783, written in the Sysmon-for-Linux vocabulary (Image, CommandLine) that the brief maps auditd:SYSCALL::execve onto. All four backends render. Raw auditd carries the same values as exe= on SYSCALL and a0..aN on a separate EXECVE record, so that feed needs a field mapping first, and auditd records no execve until -a always,exit -F arch=b64 -S execve -k exec is loaded. Zero rows means blind, not quiet.

03 · How the logic works

Two selections, ANDed. selection_tool is Image|endswith over twenty-one archiver paths — MITRE's CompressionToolPatterns knob, populated here with the tar, gzip, bzip2, xz, zstd, zip, rar, 7-Zip and cpio families; MITRE names the knob, the list is authored. selection_staging is CommandLine|contains on /tmp and /dev/shm. That is MITRE's PathRegex knob, which also names the user's home directory — left out here because a /home/ substring matches nearly every command line typed on a workstation. Both terms carry no trailing slash, and that is the detail to take away. With /tmp/, only a full path to a file matches; every bare directory form fails — tar -C /tmp -xf pkg.tgz, unzip -d /tmp pkg.zip, 7z x -o/tmp, --directory=/tmp. Those are the ordinary ways to extract into a staging directory, so the slashed version looked tighter while quietly dropping most of the behaviour. Dropping the slash also subsumes /var/tmp. Two structural misses. cd /tmp && tar xzf p.tgz puts the path on the shell's command line, not tar's, so nothing fires — a parallel selection on CurrentDirectory would close that where the feed populates it. And unpacking inside a compiled dropper, or by a runtime's own archive library (Python zipfile, Go archive/zip), execs no archiver at all.

04 · Common false positives

Overwhelmingly, from builds. Unpacking a source tarball into a scratch directory is the first step of every build, and dpkg-buildpackage, rpmbuild, pip, npm, cargo and Gradle all do it under /tmp. Container tooling unpacks layer tarballs through tar on every image pull. Browsers hand attachments through /tmp, so a person unzipping a download is identical to a hit; dracut repacks cpio archives on every kernel update, and sosreport and nightly backups stage tarballs there. Level low because the first entry dominates by a wide margin.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. The trailing-slash fix came from reading the logic, not from a log line.
tier_2: run read-only, rank by Image and parent, and find out what share of matches is packaging.
tier_3: is the analytic MITRE actually described — unpack followed by execution from the staging path inside a window, which needs a correlation engine this rule format does not have.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the tool list. Keep the decompress-only binaries ungated at a higher
Exclude by parent, not by tool: build and container runtimes are the volume.
Add CurrentDirectory|startswith on /tmp and /dev/shm if available.

Declared by the author

Software builds and package management. Unpacking a source tarball into a scratch directory is the first step of every build, and dpkg-buildpackage, rpmbuild, pip, npm, cargo, Maven and Gradle all extract archives under /tmp or a TMPDIR pointing there. On a build server or CI runner this is the dominant match by a very wide margin, and it is why the level is low rather than medium.
Container and image tooling. docker build, podman, buildah and containerd unpack layer tarballs through tar into temporary directories, so every image pull and every layer extraction on a busy node produces matches.
Ordinary user activity. Browsers and mail clients hand attachments off through /tmp, so a person downloading a .tar.gz or .zip and unpacking it where it landed looks identical to this rule.
Initramfs and boot-image tooling. dracut and mkinitramfs assemble the initrd by unpacking and repacking cpio and compressed archives in a scratch directory, and they run on every kernel, microcode and driver update.
Backup, log handling and diagnostic collection. Nightly tar jobs that stage an archive under /tmp or /var/tmp before shipping it, logrotate compressing rotated files, and support-bundle collectors such as sosreport or supportconfig that build their tarball in a temporary directory.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.015, evaluated against their process_creation events.

Share this rule

/u/siemphony/2f09cb2d-5428-4cb0-93ef-b9d946a569b6

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Archive utility run against a Linux staging directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it