Linux auditd: Alert on suspicious C2-related command executions
Alerts on auditd executions of common C2-adjacent tools when labeled with the "susp_activity" key.
FreeReviewedSigma · Medium · v3
- Product
- linux
- Service
- auditd
- Author
- Marie Euler (SigmaHQ), DRL 1.1
- Published
- 2020-05-18
- Updated
- 2026-07-31
What it detects
This rule flags Linux process activity recorded by auditd under the custom key "susp_activity". It specifically targets executions of common networking and remote access utilities associated with command-and-control behavior, including wget, curl, base64, nc/netcat/ncat, ssh, socat, wireshark/rawshark, rdesktop, and nmap. The detection relies on auditd event telemetry tied to predefined audit watches for those binaries, and focuses on the suspicious intent rather than the command arguments.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-auditd-suspicious-command-line-tool-usage-for-c2-wget-curl-nc-ssh-nmap-etc-f7158a64
title: "Linux auditd: Alert on suspicious C2-related command executions"
id: c160bfef-e015-44ea-a631-ea9b2e2b9232
status: test
description: This rule flags Linux process activity recorded by auditd under the custom key "susp_activity". It specifically targets executions of common networking and remote access utilities associated with command-and-control behavior, including wget, curl, base64, nc/netcat/ncat, ssh, socat, wireshark/rawshark, rdesktop, and nmap. The detection relies on auditd event telemetry tied to predefined audit watches for those binaries, and focuses on the suspicious intent rather than the command arguments.
references:
- https://github.com/Neo23x0/auditd
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_susp_c2_commands.yml
author: Marie Euler, Huntrule Team
date: 2020-05-18
modified: 2021-11-27
tags:
- attack.command-and-control
logsource:
product: linux
service: auditd
definition: |
Required auditd configuration:
-w /usr/bin/wget -p x -k susp_activity
-w /usr/bin/curl -p x -k susp_activity
-w /usr/bin/base64 -p x -k susp_activity
-w /bin/nc -p x -k susp_activity
-w /bin/netcat -p x -k susp_activity
-w /usr/bin/ncat -p x -k susp_activity
-w /usr/bin/ss -p x -k susp_activity
-w /usr/bin/netstat -p x -k susp_activity
-w /usr/bin/ssh -p x -k susp_activity
-w /usr/bin/scp -p x -k susp_activity
-w /usr/bin/sftp -p x -k susp_activity
-w /usr/bin/ftp -p x -k susp_activity
-w /usr/bin/socat -p x -k susp_activity
-w /usr/bin/wireshark -p x -k susp_activity
-w /usr/bin/tshark -p x -k susp_activity
-w /usr/bin/rawshark -p x -k susp_activity
-w /usr/bin/rdesktop -p x -k susp_activity
-w /usr/local/bin/rdesktop -p x -k susp_activity
-w /usr/bin/wlfreerdp -p x -k susp_activity
-w /usr/bin/xfreerdp -p x -k susp_activity
-w /usr/local/bin/xfreerdp -p x -k susp_activity
-w /usr/bin/nmap -p x -k susp_activity
(via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336)
detection:
selection:
key: susp_activity
condition: selection
falsepositives:
- Admin or User activity
level: medium
license: DRL-1.1
related:
- id: f7158a64-6204-4d6d-868a-6e6378b467e0
type: derived