Linux auditd Suspicious Command-Line Tool Usage for C2 (wget/curl/nc/ssh/nmap, etc.)

Alerts on auditd executions of common C2-adjacent tools when labeled with the "susp_activity" key.

FreeUnreviewedSigmamediumv1

linux-auditd-suspicious-command-line-tool-usage-for-c2-wget-curl-nc-ssh-nmap-etc-f7158a64

title: Linux auditd Suspicious Command-Line Tool Usage for C2 (wget/curl/nc/ssh/nmap, etc.)
id: c160bfef-e015-44ea-a631-ea9b2e2b9232
status: test
description: This rule flags Linux auditd events labeled with the key "susp_activity", which correspond to execution of common networking and encoding tools such as wget, curl, base64, nc/netcat/ncat, ssh, socat, wireshark/rawshark, rdesktop, and nmap. Attackers often use these utilities to establish or support command-and-control communications, perform data staging/encoding, or interact with remote services. The detection relies on auditd telemetry matching the configured rule key for those command executions.
references:
  - https://github.com/Neo23x0/auditd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_susp_c2_commands.yml
author: Marie Euler, Huntrule Team
date: 2020-05-18
modified: 2021-11-27
tags:
  - attack.command-and-control
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -w /usr/bin/wget -p x -k susp_activity
    -w /usr/bin/curl -p x -k susp_activity
    -w /usr/bin/base64 -p x -k susp_activity
    -w /bin/nc -p x -k susp_activity
    -w /bin/netcat -p x -k susp_activity
    -w /usr/bin/ncat -p x -k susp_activity
    -w /usr/bin/ss -p x -k susp_activity
    -w /usr/bin/netstat -p x -k susp_activity
    -w /usr/bin/ssh -p x -k susp_activity
    -w /usr/bin/scp -p x -k susp_activity
    -w /usr/bin/sftp -p x -k susp_activity
    -w /usr/bin/ftp -p x -k susp_activity
    -w /usr/bin/socat -p x -k susp_activity
    -w /usr/bin/wireshark -p x -k susp_activity
    -w /usr/bin/tshark -p x -k susp_activity
    -w /usr/bin/rawshark -p x -k susp_activity
    -w /usr/bin/rdesktop -p x -k susp_activity
    -w /usr/local/bin/rdesktop -p x -k susp_activity
    -w /usr/bin/wlfreerdp -p x -k susp_activity
    -w /usr/bin/xfreerdp -p x -k susp_activity
    -w /usr/local/bin/xfreerdp -p x -k susp_activity
    -w /usr/bin/nmap -p x -k susp_activity
    (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336)
detection:
  selection:
    key: susp_activity
  condition: selection
falsepositives:
  - Admin or User activity
level: medium
license: DRL-1.1
related:
  - id: f7158a64-6204-4d6d-868a-6e6378b467e0
    type: derived

What it detects

This rule flags Linux auditd events labeled with the key "susp_activity", which correspond to execution of common networking and encoding tools such as wget, curl, base64, nc/netcat/ncat, ssh, socat, wireshark/rawshark, rdesktop, and nmap. Attackers often use these utilities to establish or support command-and-control communications, perform data staging/encoding, or interact with remote services. The detection relies on auditd telemetry matching the configured rule key for those command executions.

Known false positives

Admin or User activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.