diff --git a/audit.rules b/audit.rules
index 41b7e22..6c3b906 100644
--- a/audit.rules
+++ b/audit.rules
@@ -413,6 +413,17 @@
 -w /usr/bin/zstd -p x -k Data_Compressed
 -w /usr/local/bin/zstd -p x -k Data_Compressed
 
+## uncompress
+-a always,exit -F arch=b32 -F path=/usr/bin/uncompress -F perm=x -F key=Data_Compressed
+-a always,exit -F arch=b64 -F path=/usr/bin/uncompress -F perm=x -F key=Data_Compressed
+
+-a always,exit -F arch=b32 -F path=/usr/sbin/uncompress -F perm=x -F key=Data_Compressed
+-a always,exit -F arch=b64 -F path=/usr/sbin/uncompress -F perm=x -F key=Data_Compressed
+
+### macOS
+-a always,exit -F arch=b32 -F path=/usr/local/bin/uncompress -F perm=x -F key=Data_Compressed
+-a always,exit -F arch=b64 -F path=/usr/local/bin/uncompress -F perm=x -F key=Data_Compressed
+
 ## Added to catch netcat on Ubuntu
 -w /bin/nc.openbsd -p x -k susp_activity
 -w /bin/nc.traditional -p x -k susp_activity