huntrule

Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords

Alerts when apt/yum/rpm/dpkg install commands include reconnaissance or proxy tool keywords.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-01-03
Updated
2026-07-31
AnalysisDetection
title: Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords
id: 19dafc75-9fa2-4203-aac0-12a028b8da43
status: test
description: This rule flags Linux process executions of package installation utilities (apt/apt-get, yum, rpm, dpkg) when the command line also contains keywords associated with common networking and recon tools (e.g., nmap, netcat, wireshark/tshark, proxychains, socat). Attackers often install these utilities to facilitate discovery, probing, or traffic inspection during intrusion. It relies on Linux process creation telemetry, including the executable path (Image ends with apt/apt-get/yum/rpm/dpkg) and command-line content containing both the install action and the listed keywords.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2026-01-01
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: linux
  category: process_creation
detection:
  selection_tool_apt:
    Image|endswith:
      - /apt
      - /apt-get
    CommandLine|contains: install
  selection_tool_yum:
    Image|endswith: /yum
    CommandLine|contains:
      - localinstall
      - install
  selection_tool_rpm:
    Image|endswith: /rpm
    CommandLine|contains: -i
  selection_tool_dpkg:
    Image|endswith: /dpkg
    CommandLine|contains:
      - --install
      - -i
  selection_keyword:
    CommandLine|contains:
      - nmap
      - " nc"
      - netcat
      - wireshark
      - tshark
      - openconnect
      - proxychains
      - socat
  condition: 1 of selection_tool_* and selection_keyword
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 700fb7e8-2981-401c-8430-be58e189e741
    type: derived