Linux: Bash Launched in Interactive Mode via "-i"

Alerts when /bash is executed with the interactive flag (-i) on Linux.

FreeUnreviewedSigmalowv1

linux-bash-launched-in-interactive-mode-via-i-6104e693

title: 'Linux: Bash Launched in Interactive Mode via "-i"'
id: da02a478-5448-4475-aee3-5f42d9df7f1a
status: test
description: This rule flags process creation events where the executed binary path ends with "/bash" and the command line contains the interactive flag " -i ". Attackers may use an interactive shell to run subsequent commands and maintain a more operator-like session during post-exploitation. It relies on Linux process creation telemetry that includes the process image path and the full command line string.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://linux.die.net/man/1/bash
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /bash
    CommandLine|contains: " -i "
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 6104e693-a7d6-4891-86cb-49a258523559
    type: derived

What it detects

This rule flags process creation events where the executed binary path ends with "/bash" and the command line contains the interactive flag " -i ". Attackers may use an interactive shell to run subsequent commands and maintain a more operator-like session during post-exploitation. It relies on Linux process creation telemetry that includes the process image path and the full command line string.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.