Linux: Shell Command Execution Using flock -u with Common Shell Paths
Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of the Linux flock utility where the command line includes ' -u ' and references common interactive shell binaries (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). This matters because flock can be used to run shell commands in contexts where attackers seek unauthorized execution or environment escape. The detection relies on process creation telemetry with access to the executable path (ending in /flock) and the full command line string.
Reporting behind it
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/flock/#shell
- elastic.cohttps://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Shell Command Execution Using flock -u with Common Shell Paths"
id: 9c4680bc-ab1b-47f6-b237-f8a9109c2632
status: test
description: This rule identifies executions of the Linux flock utility where the command line includes ' -u ' and references common interactive shell binaries (/bin/bash, /bin/dash, /bin/fish, /bin/sh, /bin/zsh). This matters because flock can be used to run shell commands in contexts where attackers seek unauthorized execution or environment escape. The detection relies on process creation telemetry with access to the executable path (ending in /flock) and the full command line string.
references:
- https://gtfobins.github.io/gtfobins/flock/#shell
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /flock
CommandLine|contains: " -u "
selection_cli:
CommandLine|contains:
- /bin/bash
- /bin/dash
- /bin/fish
- /bin/sh
- /bin/zsh
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4b09c71e-4269-4111-9cdd-107d8867f0cc
type: derived