Linux capsh Invoked with Shell Commandline Pattern

title: Linux capsh Invoked with Shell Commandline Pattern
id: 14037ebb-7aaf-453d-a070-6146d6b5a17a
status: test
description: This rule flags process executions where the binary path ends with /capsh and the command line ends with " --", indicating a likely shell invocation attempt via capsh. Attackers may use capsh to spawn an interactive shell while leveraging Linux capabilities or restricted execution paths. Detection relies on Linux process creation telemetry, matching the process image path and the tail of the command line.
references:
  - https://gtfobins.github.io/gtfobins/capsh/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /capsh
    CommandLine|endswith: " --"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a
    type: derived