Linux Command Lines Creating Symlink to /etc/passwd

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1204.001Malicious Link
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Linux process command lines containing patterns for creating a symbolic link to /etc/passwd using ln with -s and optionally -f. Attackers use symlinks to redirect file operations and potentially manipulate how privileged processes read sensitive files. The detection relies on command-line text telemetry that captures the executed ln arguments.

Reporting behind it

Related detections9 linkedT1204.001 — drag to rearrange

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious Masqueraded Windows Update Python Script Execution

ClickFix Pastejacking via Script Interpreter Command in Run Dialog MRU (via registry_set)

Suspicious cscript Execution of JavaScript Spawned by PowerShell

Suspicious Ukraine-Themed LNK Lure Files Dropped (via file_event)

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Windows Registry RunMRU Tampering with HTTP/HTTPS and Script Execution Indicators

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Linux Command Lines Creating Symlink to /etc/passwd

Pivot detection · T1204.001 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-command-line-symlink-attempts-targeting-etc-passwd-c67fc22a

title: Linux Command Lines Creating Symlink to /etc/passwd
id: 688443f5-f755-47f0-b80f-034873b6ae22
status: test
description: This rule matches Linux process command lines containing patterns for creating a symbolic link to /etc/passwd using ln with -s and optionally -f. Attackers use symlinks to redirect file operations and potentially manipulate how privileged processes read sensitive files. The detection relies on command-line text telemetry that captures the executed ln arguments.
references:
  - https://www.qualys.com/2021/05/04/21nails/21nails.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_symlink_etc_passwd.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-04-05
modified: 2021-11-27
tags:
  - attack.t1204.001
  - attack.execution
logsource:
  product: linux
detection:
  keywords:
    - ln -s -f /etc/passwd
    - ln -s /etc/passwd
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c67fc22a-0be5-4b4f-aad5-2b32c4b69523
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL