Linux: Shell Command Execution Using flock -u with Common Shell Paths

Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
Published: 2024-09-02
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies executions of the Linux flock utility where the command line includes ' -u ' and references common interactive shell binaries (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). This matters because flock can be used to run shell commands in contexts where attackers seek unauthorized execution or environment escape. The detection relies on process creation telemetry with access to the executable path (ending in /flock) and the full command line string.

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

Suspicious Credential String Enumeration via findstr to Temp Directory

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Windows: Notepad Password File Discovery via Process Creation

Linux process execution of shell via nice utility

Linux: Shell Command Execution Using flock -u with Common Shell Paths

Pivot detection · T1083 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-flock-used-to-launch-an-interactive-shell-4b09c71e

title: "Linux: Shell Command Execution Using flock -u with Common Shell Paths"
id: 9c4680bc-ab1b-47f6-b237-f8a9109c2632
status: test
description: This rule identifies executions of the Linux flock utility where the command line includes ' -u ' and references common interactive shell binaries (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). This matters because flock can be used to run shell commands in contexts where attackers seek unauthorized execution or environment escape. The detection relies on process creation telemetry with access to the executable path (ending in /flock) and the full command line string.
references:
  - https://gtfobins.github.io/gtfobins/flock/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /flock
    CommandLine|contains: " -u "
  selection_cli:
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4b09c71e-4269-4111-9cdd-107d8867f0cc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL