Linux env Execution Spawning Common Shells

Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
Published: 2024-09-02
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creations where the executed binary ends with '/env' and the command line contains one of several common shell paths (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). Spawning a shell via env can help an attacker launch interactive or scripted execution while operating within a restricted or wrapped command context. The detection relies on Linux process creation telemetry with accurate Image and CommandLine fields.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Shell Payload Piped from curl to zsh

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)

Malicious Remote Script Piped Directly to a Shell (via process_creation)

HamsaUpdate Linux Payload Download via Wget Piped to Bash (via process_creation)

Suspicious Remote Script Execution via Wget or Curl Piped to Shell (via process_creation)

Linux env Execution Spawning Common Shells

Pivot detection · T1059.004 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-detect-env-based-shell-invocation-using-common-interactive-shells-bed978f8

title: Linux env Execution Spawning Common Shells
id: 10b27514-c9df-4e1f-b8e6-2eebc7970dcf
status: test
description: This rule flags process creations where the executed binary ends with '/env' and the command line contains one of several common shell paths (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). Spawning a shell via env can help an attacker launch interactive or scripted execution while operating within a restricted or wrapped command context. The detection relies on Linux process creation telemetry with accurate Image and CommandLine fields.
references:
  - https://gtfobins.github.io/gtfobins/env/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
modified: 2026-01-08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /env
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: selection
falsepositives:
  - Github operations such as ghe-backup
level: high
license: DRL-1.1
related:
  - id: bed978f8-7f3a-432b-82c5-9286a9b3031a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL