Linux Masquerading: cp via /bin/sh ending with /crond

Alerts on Linux execve where cp runs through /bin/sh and the argument ends with /crond, indicating potential masquerading.

FreeUnreviewedSigmamediumv1

linux-masquerading-cp-via-bin-sh-ending-with-crond-9d4548fa

title: "Linux Masquerading: cp via /bin/sh ending with /crond"
id: caed63d0-6bcf-4fba-9f6d-e36d211f5534
status: test
description: This rule flags process creation events where a command invokes cp with /bin/sh as the shell and where the third argument ends with /crond. Masquerading like this can be used to disguise malicious activity as or blend in with a crond-related process, reducing scrutiny during investigation. It relies on Linux auditd telemetry capturing execve parameters for the spawned process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_masquerading_crond.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-08-22
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: execve
    a0: cp
    a1: /bin/sh
    a2|endswith: /crond
  condition: selection
level: medium
license: DRL-1.1
related:
  - id: 9d4548fa-bba0-4e88-bd66-5d5bf516cda0
    type: derived

What it detects

This rule flags process creation events where a command invokes cp with /bin/sh as the shell and where the third argument ends with /crond. Masquerading like this can be used to disguise malicious activity as or blend in with a crond-related process, reducing scrutiny during investigation. It relies on Linux auditd telemetry capturing execve parameters for the spawned process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.