Linux Bash Launched in Interactive Mode (-i)
Alerts when /bash is executed with the interactive flag (-i) on Linux.
FreeReviewedSigma · Low · v3
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_ (SigmaHQ), DRL 1.1
- Published
- 2023-04-07
- Updated
- 2026-07-31
What it detects
This rule flags process executions of the bash shell where the command line includes the interactive flag "-i". Interactive shells can be used by attackers to gain a responsive command environment, including during post-exploitation or remote session activity. It relies on Linux process creation telemetry, matching bash executions by image path and the presence of " -i " in the command line.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-bash-launched-in-interactive-mode-via-i-6104e693
title: Linux Bash Launched in Interactive Mode (-i)
id: da02a478-5448-4475-aee3-5f42d9df7f1a
status: test
description: This rule flags process executions of the bash shell where the command line includes the interactive flag "-i". Interactive shells can be used by attackers to gain a responsive command environment, including during post-exploitation or remote session activity. It relies on Linux process creation telemetry, matching bash executions by image path and the presence of " -i " in the command line.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://linux.die.net/man/1/bash
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /bash
CommandLine|contains: " -i "
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 6104e693-a7d6-4891-86cb-49a258523559
type: derived