Linux Process Creation: Interactive Bash Launching Suspicious Child Commands

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

FreeUnreviewedSigmamediumv1

linux-process-creation-interactive-bash-launching-suspicious-child-commands-ea3ecad2

title: "Linux Process Creation: Interactive Bash Launching Suspicious Child Commands"
id: 806b2ece-5403-4338-9405-0fb4b1a89110
status: test
description: This rule identifies process creation events where an interactive bash session (bash -i) spawns child commands containing indicative elements of code execution and obfuscation (e.g., '-c import ', 'base64', 'pty.spawn') or ending with common recon/utility tools (whoami, iptables, ncat, nc, netcat). Attackers may use an interactive shell to blend in while running scripted or encoded payloads and establishing pseudo-terminal behavior for more reliable execution. It relies on Linux process creation telemetry, matching parent command line context and specific characteristics of the child process command line and image path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-14
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1036
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentCommandLine: bash -i
  anomaly1:
    CommandLine|contains:
      - "-c import "
      - base64
      - pty.spawn
  anomaly2:
    Image|endswith:
      - whoami
      - iptables
      - /ncat
      - /nc
      - /netcat
  condition: selection and 1 of anomaly*
falsepositives:
  - Legitimate software that uses these patterns
level: medium
license: DRL-1.1
related:
  - id: ea3ecad2-db86-4a89-ad0b-132a10d2db55
    type: derived

What it detects

This rule identifies process creation events where an interactive bash session (bash -i) spawns child commands containing indicative elements of code execution and obfuscation (e.g., '-c import ', 'base64', 'pty.spawn') or ending with common recon/utility tools (whoami, iptables, ncat, nc, netcat). Attackers may use an interactive shell to blend in while running scripted or encoded payloads and establishing pseudo-terminal behavior for more reliable execution. It relies on Linux process creation telemetry, matching parent command line context and specific characteristics of the child process command line and image path.

Known false positives

Legitimate software that uses these patterns

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.