huntrule

Guacamole Linux: Alert on Session Showing Two Users Present Anomaly

Flags Guacamole sessions on Linux when telemetry indicates two users are present, suggesting anomalous or suspicious session activity.

FreeUnreviewedSigmahighv1
title: "Guacamole Linux: Alert on Session Showing Two Users Present Anomaly"
id: b1889dd4-c570-4a65-a03a-83e3e6d84631
status: test
description: This rule flags a suspicious Guacamole session state where two users are detected as present. Attackers may leverage shared or unexpected concurrent session presence to mask activity or coordinate access. The detection relies on Guacamole Linux service telemetry that exposes a session indicator showing the “2 users now present” condition.
references:
  - https://research.checkpoint.com/2020/apache-guacamole-rce/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1212
logsource:
  product: linux
  service: guacamole
detection:
  selection:
    - (2 users now present)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1edd77db-0669-4fef-9598-165bda82826d
    type: derived

What it detects

This rule flags a suspicious Guacamole session state where two users are detected as present. Attackers may leverage shared or unexpected concurrent session presence to mask activity or coordinate access. The detection relies on Guacamole Linux service telemetry that exposes a session indicator showing the “2 users now present” condition.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.