ImageMagick Ghostscript Delegate Binary Hijacking via PATH (T1574.009)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.