Linux nohup Execution via Process Creation (nohu p command path)

Flags Linux process launches where the image path ends with '/nohup', indicating nohup was invoked for backgrounding or persistence.

FreeUnreviewedSigmamediumv1

linux-nohup-execution-via-process-creation-nohu-p-command-path-e4ffe466

title: Linux nohup Execution via Process Creation (nohu p command path)
id: a80353f1-dd55-410c-a9d4-34ec496e475d
status: test
description: This rule flags Linux process creations where the process image path ends with '/nohup', indicating the nohup utility was invoked. Attackers may use nohup to keep processes running after logout or to persist activity in environments where interactive sessions are limited. The detection relies on process creation telemetry, specifically the executed image path suffix matching '/nohup'.
references:
  - https://gtfobins.github.io/gtfobins/nohup/
  - https://en.wikipedia.org/wiki/Nohup
  - https://www.computerhope.com/unix/unohup.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_nohup.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /nohup
  condition: selection
falsepositives:
  - Administrators or installed processes that leverage nohup
level: medium
license: DRL-1.1
related:
  - id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2
    type: derived

What it detects

This rule flags Linux process creations where the process image path ends with '/nohup', indicating the nohup utility was invoked. Attackers may use nohup to keep processes running after logout or to persist activity in environments where interactive sessions are limited. The detection relies on process creation telemetry, specifically the executed image path suffix matching '/nohup'.

Known false positives

Administrators or installed processes that leverage nohup

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.