Linux: find Command Using -exec to Spawn a Shell

Flags Linux /find executions that use -exec to launch a shell interpreter.

FreeUnreviewedSigmahighv1

linux-find-command-using-exec-to-spawn-a-shell-6adfbf8f

title: "Linux: find Command Using -exec to Spawn a Shell"
id: ad70eb14-b6c7-4d4c-8cf7-5831534b4bdf
status: test
description: This rule identifies process executions where the binary path ends with /find and the command line includes both a dot-space token and the -exec option. It further matches executions that invoke common shell interpreters (/bin/bash, /bin/dash, /bin/fish, /bin/sh, or /bin/zsh). Attackers may use find with -exec to run arbitrary commands, often as part of privilege escalation or exploitation chains. The detection relies on Linux process creation telemetry containing the Image path and full CommandLine.
references:
  - https://gtfobins.github.io/gtfobins/find/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /find
    CommandLine|contains|all:
      - " . "
      - -exec
  selection_cli:
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6adfbf8f-52be-4444-9bac-81b539624146
    type: derived

What it detects

This rule identifies process executions where the binary path ends with /find and the command line includes both a dot-space token and the -exec option. It further matches executions that invoke common shell interpreters (/bin/bash, /bin/dash, /bin/fish, /bin/sh, or /bin/zsh). Attackers may use find with -exec to run arbitrary commands, often as part of privilege escalation or exploitation chains. The detection relies on Linux process creation telemetry containing the Image path and full CommandLine.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.