Linux Command Line Symlink Attempts Targeting /etc/passwd

Alerts on Linux command lines attempting to create symlinks to /etc/passwd via ln -s/ln -f patterns.

FreeUnreviewedSigmahighv1

linux-command-line-symlink-attempts-targeting-etc-passwd-c67fc22a

title: Linux Command Line Symlink Attempts Targeting /etc/passwd
id: 688443f5-f755-47f0-b80f-034873b6ae22
status: test
description: This rule flags suspicious Linux command lines containing patterns consistent with creating symbolic links to /etc/passwd using ln with -s and optionally -f. Such actions can be part of privilege escalation or credential access attempts by redirecting sensitive file paths. It relies on command-line text telemetry that includes the invoked ln arguments, matching exact keyword strings associated with symlinking to /etc/passwd.
references:
  - https://www.qualys.com/2021/05/04/21nails/21nails.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_symlink_etc_passwd.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-04-05
modified: 2021-11-27
tags:
  - attack.t1204.001
  - attack.execution
logsource:
  product: linux
detection:
  keywords:
    - ln -s -f /etc/passwd
    - ln -s /etc/passwd
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c67fc22a-0be5-4b4f-aad5-2b32c4b69523
    type: derived

What it detects

This rule flags suspicious Linux command lines containing patterns consistent with creating symbolic links to /etc/passwd using ln with -s and optionally -f. Such actions can be part of privilege escalation or credential access attempts by redirecting sensitive file paths. It relies on command-line text telemetry that includes the invoked ln arguments, matching exact keyword strings associated with symlinking to /etc/passwd.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.