Linux Data Compressed via Utility
This rule detects the execution of common archiving utilities (zip, gzip, tar) on Linux systems. Adversaries often compress data prior to exfiltration to reduce its size and make it easier to transfer. This rule specifically looks for the 'execve' system call with 'zip', 'gzip -k', or 'tar -c' as the primary command and arguments.
Sigma
