Linux Package Installation Commands for Potential Recon Tool Deployment

title: Linux Package Installation Commands for Potential Recon Tool Deployment
id: 19dafc75-9fa2-4203-aac0-12a028b8da43
status: test
description: This rule flags Linux process executions where common system package/install utilities are invoked to install software and the command line also contains keywords associated with network reconnaissance and proxying tools. Attackers often use package managers or direct installers to quickly deploy utilities like nmap or netcat to stage discovery or pivoting capabilities. It relies on Linux process creation telemetry capturing the executable path and the full command line.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2026-01-01
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: linux
  category: process_creation
detection:
  selection_tool_apt:
    Image|endswith:
      - /apt
      - /apt-get
    CommandLine|contains: install
  selection_tool_yum:
    Image|endswith: /yum
    CommandLine|contains:
      - localinstall
      - install
  selection_tool_rpm:
    Image|endswith: /rpm
    CommandLine|contains: -i
  selection_tool_dpkg:
    Image|endswith: /dpkg
    CommandLine|contains:
      - --install
      - -i
  selection_keyword:
    CommandLine|contains:
      - nmap
      - " nc"
      - netcat
      - wireshark
      - tshark
      - openconnect
      - proxychains
      - socat
  condition: 1 of selection_tool_* and selection_keyword
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 700fb7e8-2981-401c-8430-be58e189e741
    type: derived