ImageMagick Ghostscript Delegate Hijack via Suspicious Child Process Spawning

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.