T1027.015 — Compression
Tactic: Stealth · Platforms: Linux, macOS, Windows
Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode…
Sub-technique of Obfuscated Files or Information (T1027).
Sigma detection rules (3)
T1027.015 Obfuscated Files or Information: Compression
title: "T1027.015 Obfuscated Files or Information: Compression"
id: e7ff2cfa-a10b-4782-a6de-19e32f506efd
description: 'Detects archive creation via 7-Zip/RAR/tar command-line invocations. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CompressedFileType, SFXExecutionDelay, UserContext.'
references:
- https://attack.mitre.org/techniques/T1027/015
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
- attack.stealth
- attack.t1027.015
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection_7z_rar_add:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
CommandLine|contains:
- ' a '
- '-sfx'
selection_tar_create:
Image|endswith: '\tar.exe'
CommandLine|contains:
- ' -c'
- '--create'
filter_system_account:
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: 1 of selection_* and not filter_system_account
falsepositives:
- Legitimate archiving for backups/transfer.
level: medium
T1027.015 Obfuscated Files or Information: Compression
title: "T1027.015 Obfuscated Files or Information: Compression"
id: f5d37de9-e249-43dd-ba61-b29447334884
description: 'Detection Strategy for Compressed Payload Creation and Execution. Matching any tar/gzip/zip/unzip invocation touching /tmp/ or /dev/shm/ was extremely broad and indistinguishable from routine package/build/CI archive activity, with no correlation to subsequent execution that would indicate payload staging/obfuscation. This base rule now flags the compression event; the paired correlation rule below requires an execution from the same staging directory to follow within a short window, approximating actual obfuscated-payload deployment rather than bare archive activity. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PathRegex, CompressionToolPatterns, ExecutionAfterUnpackWindow.'
references:
- https://attack.mitre.org/techniques/T1027/015
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
- attack.stealth
- attack.t1027.015
logsource:
category: process_creation
product: linux
detection:
selection:
type: EXECVE
a0|endswith:
- '/tar'
- '/gzip'
- '/zip'
- '/unzip'
a1|contains:
- '/tmp/'
- '/dev/shm/'
condition: selection
falsepositives:
- Routine archive extraction/creation in temp directories by package managers, CI jobs, and normal user activity; this base rule alone is low-signal, see the companion correlation rule below requiring a subsequent execution from the same staging directory.
level: low
---
title: "T1027.015 Obfuscated Files or Information: Compression - Execution Following Extraction"
id: b3e8f5c1-9d4a-4b7e-8c1f-2a6d9e5b3f74
description: 'Correlation companion for f5d37de9-e249-43dd-ba61-b29447334884: requires the tar/gzip/zip/unzip event under /tmp or /dev/shm to be followed by an execution from the same staging path within a 10-minute window, approximating actual obfuscated-payload extraction-then-execution rather than routine archive activity alone.'
references:
- https://attack.mitre.org/techniques/T1027/015
author: Shahrukh Khan
date: 2026-07-26
license: MIT
tags:
- attack.stealth
- attack.t1027.015
logsource:
category: process_creation
product: linux
detection:
selection:
type: EXECVE
exe|contains:
- '/tmp/'
- '/dev/shm/'
condition: selection
falsepositives:
- Legitimate installers and CI/build systems execute helper binaries staged in /tmp or /dev/shm after extraction; this is used only as one half of the temporal correlation below.
level: informational
---
title: "T1027.015 Obfuscated Files or Information: Compression - Confirmed Extract-then-Execute Chain"
id: c4f9a6d2-1e5b-4c8f-9d2a-3b7e0f6c4a85
description: 'Correlation companion linking f5d37de9-e249-43dd-ba61-b29447334884 (compression tool activity) and b3e8f5c1-9d4a-4b7e-8c1f-2a6d9e5b3f74 (execution from a staging path): requires both to occur within a 10-minute window, approximating the extract-then-execute chain that indicates a compressed payload was actually staged and run rather than routine archive activity alone.'
status: experimental
correlation:
type: temporal_ordered
rules:
- f5d37de9-e249-43dd-ba61-b29447334884
- b3e8f5c1-9d4a-4b7e-8c1f-2a6d9e5b3f74
timespan: 10m
condition: "f5d37de9-e249-43dd-ba61-b29447334884 and b3e8f5c1-9d4a-4b7e-8c1f-2a6d9e5b3f74"
level: high
T1027.015 Obfuscated Files or Information: Compression
title: "T1027.015 Obfuscated Files or Information: Compression"
id: d552e4d2-462c-45cc-9a5a-1905f1f60a3c
description: 'Detection Strategy for Compressed Payload Creation and Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DecompressionPathMatch, ToolBinaryNames, FollowOnExecutionDelta.'
references:
- https://attack.mitre.org/techniques/T1027/015
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
- attack.stealth
- attack.t1027.015
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- '/tar'
- '/unzip'
- '/ditto'
selection_target:
CommandLine|contains:
- '/private/tmp/'
- '/Library/Application Support/'
condition: selection and selection_target
falsepositives:
- Standard installer or archive workflows that decompress content into application support directories.
level: medium
Related sub-techniques
Explore