deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Privileged User Has Been Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Pawel Mazur
Date: 2022-12-21
ATT&CK techniques: T1136.001, T1098
Log source: linux/

Description:
Detects the addition of a new user to a privileged group such as "root" or "sudo"

Detection logic:
{
  "selection_new_user": [
    "new user"
  ],
  "selection_uids_gids": [
    "GID=0,",
    "UID=0,",
    "GID=10,",
    "GID=27,"
  ],
  "condition": "all of selection_*"
}

References:
  - https://digital.nhs.uk/cyber-alerts/2018/cc-2825
  - https://linux.die.net/man/8/useradd
  - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid
Sigma Detection Rule: Remote File Copy
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Ömer Günal
Date: 2020-06-18
ATT&CK techniques: T1105
Log source: linux/

Description:
Detects the use of tools that copy files from or to remote systems

Detection logic:
{
  "tools": [
    "scp ",
    "rsync ",
    "sftp "
  ],
  "filter": [
    "@",
    ":"
  ],
  "condition": "tools and filter"
}

References:
  - https://www.cisa.gov/stopransomware/ransomware-guide
Sigma Detection Rule: Commands to Clear or Remove the Syslog - Builtin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2021-09-10
ATT&CK techniques: T1565.001
Log source: linux/

Description:
Detects specific commands commonly used to remove or empty the syslog

Detection logic:
{
  "selection": [
    "rm /var/log/syslog",
    "rm -r /var/log/syslog",
    "rm -f /var/log/syslog",
    "rm -rf /var/log/syslog",
    "mv /var/log/syslog",
    " >/var/log/syslog",
    " > /var/log/syslog"
  ],
  "falsepositives": [
    "/syslog."
  ],
  "condition": "selection and not falsepositives"
}

References:
  - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
Sigma Detection Rule: JexBoss Command Sequence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-08-24
ATT&CK techniques: T1059.004
Log source: linux/

Description:
Detects suspicious command sequence that JexBoss

Detection logic:
{
  "keywords": {
    "|all": [
      "bash -c /bin/bash",
      "&/dev/tcp/"
    ]
  },
  "condition": "keywords"
}

References:
  - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A
Sigma Detection Rule: Linux Command History Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Patrick Bareiss
Date: 2019-03-24
ATT&CK techniques: T1070.003
Log source: linux/

Description:
Detects commands that try to clear or tamper with the Linux command history.
This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".


Detection logic:
{
  "keywords": [
    "cat /dev/null >*sh_history",
    "cat /dev/zero >*sh_history",
    "chattr +i*sh_history",
    "echo \"\" >*sh_history",
    "empty_bash_history",
    "export HISTFILESIZE=0",
    "history -c",
    "history -w",
    "ln -sf /dev/null *sh_history",
    "ln -sf /dev/zero *sh_history",
    "rm *sh_history",
    "shopt -ou history",
    "shopt -uo history",
    "shred *sh_history",
    "truncate -s0 *sh_history"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md
  - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics
  - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/
Sigma Detection Rule: Suspicious Use of /dev/tcp
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-10
Log source: linux/

Description:
Detects suspicious command with /dev/tcp

Detection logic:
{
  "keywords": [
    "cat </dev/tcp/",
    "exec 3<>/dev/tcp/",
    "echo >/dev/tcp/",
    "bash -i >& /dev/tcp/",
    "sh -i >& /dev/udp/",
    "0<&196;exec 196<>/dev/tcp/",
    "exec 5<>/dev/tcp/",
    "(sh)0>/dev/tcp/",
    "bash -c 'bash -i >& /dev/tcp/",
    "echo -e '#!/bin/bash\\nbash -i >& /dev/tcp/"
  ],
  "condition": "keywords"
}

References:
  - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/
  - https://book.hacktricks.xyz/shells/shells/linux
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan
Sigma Detection Rule: Modifying Crontab
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pawel Mazur
Date: 2022-04-16
ATT&CK techniques: T1053.003
Log source: linux/

Description:
Detects suspicious modification of crontab file.

Detection logic:
{
  "keywords": [
    "REPLACE"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
Sigma Detection Rule: Suspicious VSFTPD Error Messages
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-07-05
ATT&CK techniques: T1190
Log source: linux/

Description:
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Detection logic:
{
  "keywords": [
    "Connection refused: too many sessions for this address.",
    "Connection refused: tcp_wrappers denial.",
    "Bad HTTP verb.",
    "port and pasv both active",
    "pasv and port both active",
    "Transfer done (but failed to open directory).",
    "Could not set file modification time.",
    "bug: pid active in ptrace_sandbox_free",
    "PTRACE_SETOPTIONS failure",
    "weird status:",
    "couldn't handle sandbox event",
    "syscall * out of bounds",
    "syscall not permitted:",
    "syscall validate failed:",
    "Input line too long.",
    "poor buffer accounting in str_netfd_alloc",
    "vsf_sysutil_read_loop"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/dagwieers/vsftpd/
Sigma Detection Rule: Guacamole Two Users Sharing Session Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-03
ATT&CK techniques: T1212
Log source: linux/

Description:
Detects suspicious session with two users present

Detection logic:
{
  "selection": [
    "(2 users now present)"
  ],
  "condition": "selection"
}

References:
  - https://research.checkpoint.com/2020/apache-guacamole-rce/
Sigma Detection Rule: Relevant ClamAV Message
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2017-03-01
ATT&CK techniques: T1588.001
Log source: linux/

Description:
Detects relevant ClamAV messages

Detection logic:
{
  "keywords": [
    "Trojan*FOUND",
    "VirTool*FOUND",
    "Webshell*FOUND",
    "Rootkit*FOUND",
    "Htran*FOUND"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml
Sigma Detection Rule: Suspicious OpenSSH Daemon Error
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-06-30
ATT&CK techniques: T1190
Log source: linux/

Description:
Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Detection logic:
{
  "keywords": [
    "unexpected internal error",
    "unknown or unsupported key type",
    "invalid certificate signing key",
    "invalid elliptic curve value",
    "incorrect signature",
    "error in libcrypto",
    "unexpected bytes remain after decoding",
    "fatal: buffer_get_string: bad string",
    "Local: crc32 compensation attack",
    "bad client public DH value",
    "Corrupted MAC on input"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
Sigma Detection Rule: Disabling Security Tools - Builtin
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ömer Günal, Alejandro Ortuno, oscd.community
Date: 2020-06-17
ATT&CK techniques: T1686
Log source: linux/

Description:
Detects disabling security tools

Detection logic:
{
  "keywords": [
    "stopping iptables",
    "stopping ip6tables",
    "stopping firewalld",
    "stopping cbdaemon",
    "stopping falcon-sensor"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
Sigma Detection Rule: Suspicious Named Error
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-02-20
ATT&CK techniques: T1190
Log source: linux/

Description:
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Detection logic:
{
  "keywords": [
    " dropping source port zero packet from ",
    " denied AXFR from ",
    " exiting (due to fatal error)"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
Sigma Detection Rule: History File Deletion
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1565.001
Log source: linux/process_creation

Description:
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/rm",
      "/unlink",
      "/shred"
    ]
  },
  "selection_history": [
    {
      "CommandLine|contains": [
        "/.bash_history",
        "/.zsh_history"
      ]
    },
    {
      "CommandLine|endswith": [
        "_history",
        ".history",
        "zhistory"
      ]
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
Sigma Detection Rule: Suspicious Invocation of Shell via Rsync
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Florian Roth
Date: 2025-01-18
ATT&CK techniques: T1059, T1203
Log source: linux/process_creation

Description:
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "/rsync",
      "/rsyncd"
    ],
    "Image|endswith": [
      "/ash",
      "/bash",
      "/csh",
      "/dash",
      "/ksh",
      "/sh",
      "/tcsh",
      "/zsh"
    ]
  },
  "filter_main_expected": {
    "CommandLine|contains": " -e "
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
  - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
Sigma Detection Rule: Suspicious Java Children Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-03
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects java process spawning suspicious children

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/java",
    "CommandLine|contains": [
      "/bin/sh",
      "bash",
      "dash",
      "ksh",
      "zsh",
      "csh",
      "fish",
      "curl",
      "wget",
      "python"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.tecmint.com/different-types-of-linux-shells/
Sigma Detection Rule: Suspicious Package Installed - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
ATT&CK techniques: T1553.004
Log source: linux/process_creation

Description:
Detects installation of suspicious packages using system installation utilities

Detection logic:
{
  "selection_tool_apt": {
    "Image|endswith": [
      "/apt",
      "/apt-get"
    ],
    "CommandLine|contains": "install"
  },
  "selection_tool_yum": {
    "Image|endswith": "/yum",
    "CommandLine|contains": [
      "localinstall",
      "install"
    ]
  },
  "selection_tool_rpm": {
    "Image|endswith": "/rpm",
    "CommandLine|contains": "-i"
  },
  "selection_tool_dpkg": {
    "Image|endswith": "/dpkg",
    "CommandLine|contains": [
      "--install",
      "-i"
    ]
  },
  "selection_keyword": {
    "CommandLine|contains": [
      "nmap",
      " nc",
      "netcat",
      "wireshark",
      "tshark",
      "openconnect",
      "proxychains",
      "socat"
    ]
  },
  "condition": "1 of selection_tool_* and selection_keyword"
}

References:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e[PII_REDACTED]897b620c25fde1ea258c8218fe3d3/history.txt
Sigma Detection Rule: Linux Base64 Encoded Pipe to Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-07-26
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects suspicious process command line that uses base64 encoded input for execution with a shell

Detection logic:
{
  "selection_base64": {
    "CommandLine|contains": "base64 "
  },
  "selection_exec": [
    {
      "CommandLine|contains": [
        "| bash ",
        "| sh ",
        "|bash ",
        "|sh "
      ]
    },
    {
      "CommandLine|endswith": [
        " |sh",
        "| bash",
        "| sh",
        "|bash"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/arget13/DDexec
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: System Information Discovery
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: Ömer Günal, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects system information discovery commands

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/uname",
      "/hostname",
      "/uptime",
      "/lspci",
      "/dmidecode",
      "/lscpu",
      "/lsmod"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md
Sigma Detection Rule: Suspicious Nohup Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
Log source: linux/process_creation

Description:
Detects execution of binaries located in potentially suspicious locations via "nohup"

Detection logic:
{
  "selection": {
    "Image|endswith": "/nohup",
    "CommandLine|contains": "/tmp/"
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: ESXi Network Configuration Discovery Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1033, T1007, T1059.012
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "network"
  },
  "selection_cli": {
    "CommandLine|contains": [
      " get",
      " list"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html
Sigma Detection Rule: Shell Invocation via Apt - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-28
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/apt",
      "/apt-get"
    ],
    "CommandLine|contains": "APT::Update::Pre-Invoke::="
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/apt/
  - https://gtfobins.github.io/gtfobins/apt-get/
Sigma Detection Rule: Access of Sudoers File Content
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1592.004
Log source: linux/process_creation

Description:
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/cat",
      "/ed",
      "/egrep",
      "/emacs",
      "/fgrep",
      "/grep",
      "/head",
      "/less",
      "/more",
      "/nano",
      "/tail"
    ],
    "CommandLine|contains": " /etc/sudoers"
  },
  "condition": "selection"
}

References:
  - https://github.com/sleventyeleven/linuxprivchecker/
Sigma Detection Rule: User Added To Root/Sudoers Group Using Usermod
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: TuanLe (GTSC)
Date: 2022-12-21
Log source: linux/process_creation

Description:
Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Detection logic:
{
  "selection": {
    "Image|endswith": "/usermod",
    "CommandLine|contains": [
      "-aG root",
      "-aG sudoers"
    ]
  },
  "condition": "selection"
}

References:
  - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
  - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
Sigma Detection Rule: Shell Execution via Find - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "/find",
    "CommandLine|contains|all": [
      " . ",
      "-exec"
    ]
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/find/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
Sigma Detection Rule: Suspicious Curl Change User Agents - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1071.001
Log source: linux/process_creation

Description:
Detects a suspicious curl process start on linux with set useragent options

Detection logic:
{
  "selection": {
    "Image|endswith": "/curl",
    "CommandLine|contains": [
      " -A ",
      " --user-agent "
    ]
  },
  "condition": "selection"
}

References:
  - https://curl.se/docs/manpage.html
Sigma Detection Rule: Inline Python Execution - Spawn Shell Via OS System Library
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "/python",
        "/python2",
        "/python3"
      ]
    },
    {
      "Image|contains": [
        "/python2.",
        "/python3."
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -c ",
      "os.system("
    ],
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/python/#shell
Sigma Detection Rule: Potential Discovery Activity Using Find - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-28
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects usage of "find" binary in a suspicious manner to perform discovery

Detection logic:
{
  "selection": {
    "Image|endswith": "/find",
    "CommandLine|contains": [
      "-perm -4000",
      "-perm -2000",
      "-perm 0777",
      "-perm -222",
      "-perm -o w",
      "-perm -o x",
      "-perm -u=s",
      "-perm -g=s"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
Sigma Detection Rule: Shell Invocation via Env Command - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1059.004
Log source: linux/process_creation

Description:
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.


Detection logic:
{
  "selection": {
    "Image|endswith": "/env",
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/env/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html