Linux Find Command Used to Execute a Shell via -exec
Flags Linux /find executions that use -exec to launch a shell interpreter.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where the command line indicates /find being used with the -exec option and a shell binary is referenced. Using find -exec to spawn shells can support unauthorized command execution and may be used as a step in privilege escalation or exploitation workflows. It relies on Linux process creation telemetry, matching command-line patterns containing “-exec”, “ . ”, and one of several common shell paths (/bin/bash, /bin/sh, /bin/dash, /bin/fish, /bin/zsh).
Reporting behind it
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/find/#shell
- elastic.cohttps://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Find Command Used to Execute a Shell via -exec
id: ad70eb14-b6c7-4d4c-8cf7-5831534b4bdf
status: test
description: This rule flags process executions where the command line indicates /find being used with the -exec option and a shell binary is referenced. Using find -exec to spawn shells can support unauthorized command execution and may be used as a step in privilege escalation or exploitation workflows. It relies on Linux process creation telemetry, matching command-line patterns containing “-exec”, “ . ”, and one of several common shell paths (/bin/bash, /bin/sh, /bin/dash, /bin/fish, /bin/zsh).
references:
- https://gtfobins.github.io/gtfobins/find/#shell
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /find
CommandLine|contains|all:
- " . "
- -exec
selection_cli:
CommandLine|contains:
- /bin/bash
- /bin/dash
- /bin/fish
- /bin/sh
- /bin/zsh
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6adfbf8f-52be-4444-9bac-81b539624146
type: derived