deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Disabling Security Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ömer Günal, Alejandro Ortuno, oscd.community
Date: 2020-06-17
ATT&CK techniques: T1686
Log source: linux/process_creation

Description:
Detects disabling security tools

Detection logic:
{
  "selection_iptables_1": {
    "Image|endswith": "/service",
    "CommandLine|contains|all": [
      "iptables",
      "stop"
    ]
  },
  "selection_iptables_2": {
    "Image|endswith": "/service",
    "CommandLine|contains|all": [
      "ip6tables",
      "stop"
    ]
  },
  "selection_iptables_3": {
    "Image|endswith": "/chkconfig",
    "CommandLine|contains|all": [
      "iptables",
      "stop"
    ]
  },
  "selection_iptables_4": {
    "Image|endswith": "/chkconfig",
    "CommandLine|contains|all": [
      "ip6tables",
      "stop"
    ]
  },
  "selection_firewall_1": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains|all": [
      "firewalld",
      "stop"
    ]
  },
  "selection_firewall_2": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains|all": [
      "firewalld",
      "disable"
    ]
  },
  "selection_carbonblack_1": {
    "Image|endswith": "/service",
    "CommandLine|contains|all": [
      "cbdaemon",
      "stop"
    ]
  },
  "selection_carbonblack_2": {
    "Image|endswith": "/chkconfig",
    "CommandLine|contains|all": [
      "cbdaemon",
      "off"
    ]
  },
  "selection_carbonblack_3": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains|all": [
      "cbdaemon",
      "stop"
    ]
  },
  "selection_carbonblack_4": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains|all": [
      "cbdaemon",
      "disable"
    ]
  },
  "selection_selinux": {
    "Image|endswith": "/setenforce",
    "CommandLine|cont

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
Sigma Detection Rule: Remove Immutable File Attribute
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1222.002
Log source: linux/process_creation

Description:
Detects usage of the 'chattr' utility to remove immutable file attribute.

Detection logic:
{
  "selection": {
    "Image|endswith": "/chattr",
    "CommandLine|contains": " -i "
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
Sigma Detection Rule: ESXi Storage Information Discovery Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1033, T1007, T1059.012
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "storage"
  },
  "selection_cli": {
    "CommandLine|contains": [
      " get",
      " list"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
  - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
Sigma Detection Rule: Security Software Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1518.001
Log source: linux/process_creation

Description:
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/grep",
      "/egrep"
    ],
    "CommandLine|contains": [
      "nessusd",
      "td-agent",
      "packetbeat",
      "filebeat",
      "auditbeat",
      "osqueryd",
      "cbagentd",
      "falcond"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md
Sigma Detection Rule: Linux Shell Pipe to Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-14
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Detection logic:
{
  "selection": {
    "CommandLine|startswith": [
      "sh -c ",
      "bash -c "
    ]
  },
  "selection_exec": [
    {
      "CommandLine|contains": [
        "| bash ",
        "| sh ",
        "|bash ",
        "|sh "
      ]
    },
    {
      "CommandLine|endswith": [
        "| bash",
        "| sh",
        "|bash",
        " |sh"
      ]
    }
  ],
  "condition": "all of selection*"
}

References:
  - Internal Research
Sigma Detection Rule: ESXi Account Creation Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cedric Maurugeon
Date: 2023-08-22
ATT&CK techniques: T1136, T1059.012
Log source: linux/process_creation

Description:
Detects user account creation on ESXi system via esxcli

Detection logic:
{
  "selection": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains|all": [
      "system ",
      "account ",
      "add "
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
Sigma Detection Rule: Local Groups Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ömer Günal, Alejandro Ortuno, oscd.community
Date: 2020-10-11
ATT&CK techniques: T1069.001
Log source: linux/process_creation

Description:
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/groups"
  },
  "selection_2": {
    "Image|endswith": [
      "/cat",
      "/ed",
      "/head",
      "/less",
      "/more",
      "/nano",
      "/tail",
      "/vi",
      "/vim"
    ],
    "CommandLine|contains": "/etc/group"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
Sigma Detection Rule: Potential Perl Reverse Shell Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-07
Log source: linux/process_creation

Description:
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/perl",
    "CommandLine|contains": " -e "
  },
  "selection_content": [
    {
      "CommandLine|contains|all": [
        "fdopen(",
        "::Socket::INET"
      ]
    },
    {
      "CommandLine|contains|all": [
        "Socket",
        "connect",
        "open",
        "exec"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: Suspicious Invocation of Shell via AWK - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/awk",
      "/gawk",
      "/mawk",
      "/nawk"
    ],
    "CommandLine|contains": "BEGIN {system"
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/awk/#shell
  - https://gtfobins.github.io/gtfobins/gawk/#shell
  - https://gtfobins.github.io/gtfobins/nawk/#shell
  - https://gtfobins.github.io/gtfobins/mawk/#shell
Sigma Detection Rule: Install Root Certificate
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ömer Günal, oscd.community
Date: 2020-10-05
ATT&CK techniques: T1553.004
Log source: linux/process_creation

Description:
Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/update-ca-certificates",
      "/update-ca-trust"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
Sigma Detection Rule: Linux Webshell Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-10-15
ATT&CK techniques: T1505.003
Log source: linux/process_creation

Description:
Detects suspicious sub processes of web server processes

Detection logic:
{
  "selection_general": {
    "ParentImage|endswith": [
      "/httpd",
      "/lighttpd",
      "/nginx",
      "/apache2",
      "/node",
      "/caddy"
    ]
  },
  "selection_tomcat": {
    "ParentCommandLine|contains|all": [
      "/bin/java",
      "tomcat"
    ]
  },
  "selection_websphere": {
    "ParentCommandLine|contains|all": [
      "/bin/java",
      "websphere"
    ]
  },
  "sub_processes": {
    "Image|endswith": [
      "/whoami",
      "/ifconfig",
      "/ip",
      "/bin/uname",
      "/bin/cat",
      "/bin/crontab",
      "/hostname",
      "/iptables",
      "/netstat",
      "/pwd",
      "/route"
    ]
  },
  "condition": "1 of selection_* and sub_processes"
}

References:
  - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
  - https://media.defense.gov/2020/Jun/09/[PII_REDACTED]/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
Sigma Detection Rule: OMIGOD SCX RunAsProvider ExecuteShellCommand
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1068, T1190, T1203
Log source: linux/process_creation

Description:
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.


Detection logic:
{
  "selection": {
    "User": "root",
    "LogonId": 0,
    "CurrentDirectory": "/var/opt/microsoft/scx/tmp",
    "CommandLine|contains": "/bin/sh"
  },
  "condition": "selection"
}

References:
  - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
  - https://github.com/Azure/Azure-Sentinel/pull/3059
Sigma Detection Rule: Remove Scheduled Cron Task/Job
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
Log source: linux/process_creation

Description:
Detects usage of the 'crontab' utility to remove the current crontab.
This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible


Detection logic:
{
  "selection": {
    "Image|endswith": "crontab",
    "CommandLine|contains": " -r"
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
Sigma Detection Rule: Scheduled Cron Task/Job - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1053.003
Log source: linux/process_creation

Description:
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Detection logic:
{
  "selection": {
    "Image|endswith": "crontab",
    "CommandLine|contains": "/tmp/"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
Sigma Detection Rule: Potential Linux Process Code Injection Via DD Utility
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseph Kamau
Date: 2023-12-01
ATT&CK techniques: T1055.009
Log source: linux/process_creation

Description:
Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Detection logic:
{
  "selection": {
    "Image|endswith": "/dd",
    "CommandLine|contains|all": [
      "of=",
      "/proc/",
      "/mem"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
  - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
Sigma Detection Rule: OS Architecture Discovery Via Grep
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"


Detection logic:
{
  "selection_process": {
    "Image|endswith": "/grep"
  },
  "selection_architecture": {
    "CommandLine|endswith": [
      "aarch64",
      "arm",
      "i386",
      "i686",
      "mips",
      "x86_64"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Linux Network Service Scanning Tools Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
Date: 2020-10-21
ATT&CK techniques: T1046
Log source: linux/process_creation

Description:
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Detection logic:
{
  "selection_netcat": {
    "Image|endswith": [
      "/nc",
      "/ncat",
      "/netcat",
      "/socat"
    ]
  },
  "selection_network_scanning_tools": {
    "Image|endswith": [
      "/autorecon",
      "/hping",
      "/hping2",
      "/hping3",
      "/naabu",
      "/nmap",
      "/nping",
      "/telnet",
      "/zenmap"
    ]
  },
  "filter_main_netcat_listen_flag": {
    "CommandLine|contains": [
      " --listen ",
      " -l "
    ]
  },
  "condition": "(selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
  - https://github.com/projectdiscovery/naabu
  - https://github.com/Tib3rius/AutoRecon
Sigma Detection Rule: OMIGOD SCX RunAsProvider ExecuteScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1068, T1190, T1203
Log source: linux/process_creation

Description:
Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.


Detection logic:
{
  "selection": {
    "User": "root",
    "LogonId": 0,
    "CurrentDirectory": "/var/opt/microsoft/scx/tmp",
    "CommandLine|contains": "/etc/opt/microsoft/scx/conf/tmpdir/scx"
  },
  "condition": "selection"
}

References:
  - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
  - https://github.com/Azure/Azure-Sentinel/pull/3059
Sigma Detection Rule: Python One-Liners with Base64 Decoding - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-09
ATT&CK techniques: T1059.006, T1027.010
Log source: linux/process_creation

Description:
Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.


Detection logic:
{
  "selection_img": {
    "Image|contains": "/python"
  },
  "selection_cli": {
    "CommandLine|contains|all": [
      "import",
      "base64",
      " -c"
    ],
    "CommandLine|contains": [
      ".decode",
      "b16decode",
      "b32decode",
      "b32hexdecode",
      "b64decode",
      "b85decode",
      "z85decode"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://docs.python.org/3/library/base64.html
  - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
Sigma Detection Rule: Potential Netcat Reverse Shell Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-07
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Detection logic:
{
  "selection_nc": {
    "Image|endswith": [
      "/nc",
      "/ncat"
    ]
  },
  "selection_flags": {
    "CommandLine|contains": [
      " -c ",
      " -e "
    ]
  },
  "selection_shell": {
    "CommandLine|contains": [
      " ash",
      " bash",
      " bsh",
      " csh",
      " ksh",
      " pdksh",
      " sh",
      " tcsh",
      "/bin/ash",
      "/bin/bash",
      "/bin/bsh",
      "/bin/csh",
      "/bin/ksh",
      "/bin/pdksh",
      "/bin/sh",
      "/bin/tcsh",
      "/bin/zsh",
      "$IFSash",
      "$IFSbash",
      "$IFSbsh",
      "$IFScsh",
      "$IFSksh",
      "$IFSpdksh",
      "$IFSsh",
      "$IFStcsh",
      "$IFSzsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/
  - https://www.infosecademy.com/netcat-reverse-shells/
  - https://man7.org/linux/man-pages/man1/ncat.1.html
Sigma Detection Rule: Linux Sudo Chroot Execution
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
Date: 2025-10-02
ATT&CK techniques: T1068
Log source: linux/process_creation

Description:
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.


Detection logic:
{
  "selection": {
    "Image|endswith": "/sudo",
    "CommandLine|contains": [
      " --chroot ",
      "sudo -R "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa[PII_REDACTED]c3ed4bfa434c197ad4/exploit.sh
Sigma Detection Rule: Linux Logs Clearing Attempts
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Ömer Günal, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1685.006
Log source: linux/process_creation

Description:
Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/rm",
      "/rmdir",
      "/shred",
      "/unlink"
    ],
    "CommandLine|contains": [
      "/var/log",
      "/var/spool/mail"
    ]
  },
  "filter_main_legit_systat": {
    "Image|endswith": "/rm",
    "CommandLine|startswith": "rm -f /var/log/sysstat/"
  },
  "filter_main_dmseg": {
    "Image|endswith": "/rm",
    "CommandLine|startswith": "rm -f -- /var/log//dmesg"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
Sigma Detection Rule: Crontab Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1007
Log source: linux/process_creation

Description:
Detects usage of crontab to list the tasks of the user

Detection logic:
{
  "selection": {
    "Image|endswith": "/crontab",
    "CommandLine|contains": " -l"
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Shell Execution GCC  - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/c89",
      "/c99",
      "/gcc"
    ],
    "CommandLine|contains": "-wrapper"
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/bin/bash,-s",
      "/bin/dash,-s",
      "/bin/fish,-s",
      "/bin/sh,-s",
      "/bin/zsh,-s"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/gcc/#shell
  - https://gtfobins.github.io/gtfobins/c89/#shell
  - https://gtfobins.github.io/gtfobins/c99/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html