ImageMagick Ghostscript Delegate Hijack — Suspicious gs/gswin64c Execution

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.