Linux Process Command Lines Showing Pnscan Binary Data Transfer Usage

title: Linux Process Command Lines Showing Pnscan Binary Data Transfer Usage
id: 206c78a6-ebe7-432d-94eb-b09651f0c469
status: test
description: This rule matches Linux process creation command lines that include the Pnscan-style parameters for sending or receiving binary data over the network. Attackers may use this functionality to exchange payload data between hosts while disguising it as binary transfer activity. Telemetry relies on process_creation events with captured command-line arguments that match the defined hexadecimal-byte pattern.
author: David Burkett (@signalblur), Huntrule Team
date: 2024-04-16
references:
  - https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence
  - https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf
  - https://regex101.com/r/RugQYK/1
  - https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|re: -(W|R)\s?(\s|"|')([0-9a-fA-F]{2}\s?){2,20}(\s|"|')
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 97de11cd-4b67-4abf-9a8b-1020e670aa9e
    type: derived