Linux auditd: Executing suspicious chmod and cp commands

Triggers on auditd EXECVE events for chmod (777/u+s) and cp overwriting /bin/ksh or /bin/sh.

FreeReviewedSigma · Medium · v3

Product: linux
Service: auditd
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-12-12
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process execution events where a user runs specific chmod or cp commands on Linux, including setting world-writable permissions or enabling the setuid bit. Attackers commonly use these actions to modify file permissions or replace system shells to persist or escalate privileges. The detection relies on auditd EXECVE telemetry capturing the executed program name and its first argument values.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Suspicious Remote Script Download Piped to Shell via Wget or Curl on Linux

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

Suspicious Remote Script Piped Directly to Interpreter in CI Pipeline

Malicious Node Runtime Spawning Shell to Download Python Payload via Axios Compromise

Malicious Remote Script Piped to Shell via Curl (via process_creation)

Possible GTFOBins Shell Breakout via Unix Utilities

Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation

Suspicious Downloaded Shell Stager Made Executable Via Chmod 777

Linux auditd: Executing suspicious chmod and cp commands

Pivot detection · T1059.004 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-suspicious-chmod-and-file-replacement-via-cp-1543ae20

title: "Linux auditd: Executing suspicious chmod and cp commands"
id: 41584740-bc63-40a4-b24e-3e55b1b62554
status: test
description: This rule matches process execution events where a user runs specific chmod or cp commands on Linux, including setting world-writable permissions or enabling the setuid bit. Attackers commonly use these actions to modify file permissions or replace system shells to persist or escalate privileges. The detection relies on auditd EXECVE telemetry capturing the executed program name and its first argument values.
references:
  - Internal Research - mostly derived from exploit code including code in MSF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_susp_cmds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-12-12
modified: 2022-10-05
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  service: auditd
detection:
  cmd1:
    type: EXECVE
    a0: chmod
    a1: 777
  cmd2:
    type: EXECVE
    a0: chmod
    a1: u+s
  cmd3:
    type: EXECVE
    a0: cp
    a1: /bin/ksh
  cmd4:
    type: EXECVE
    a0: cp
    a1: /bin/sh
  condition: 1 of cmd*
falsepositives:
  - Admin activity
level: medium
license: DRL-1.1
related:
  - id: 1543ae20-cbdf-4ec1-8d12-7664d667a825
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL