CmdID

CmdID / Commands

funzip

Print the content of the first (non-directory) member in an archive without extraction. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Print the content of the first member in a Zip archive

funzip path/to/archive.zipIdentify

Print the content in a gzip archive

funzip path/to/archive.gzIdentify

Decrypt a Zip or gzip archive and print the content

funzip -password password path/to/archiveIdentify

What detects it

Sigma process creation rules that name funzip
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)