Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions where the binary path ends with "/capsh" and the command line ends with " --", indicating an attempt to use capsh to spawn a shell. Attackers may leverage capsh to break out of restricted environments or gain interactive command execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.
Reporting behind it
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/capsh/#shell
- elastic.cohttps://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
id: 14037ebb-7aaf-453d-a070-6146d6b5a17a
status: test
description: This rule flags Linux process executions where the binary path ends with "/capsh" and the command line ends with " --", indicating an attempt to use capsh to spawn a shell. Attackers may leverage capsh to break out of restricted environments or gain interactive command execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.
references:
- https://gtfobins.github.io/gtfobins/capsh/#shell
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /capsh
CommandLine|endswith: " --"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a
type: derived