huntrule

Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-03-14
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where an interactive Bash session (bash -i) spawns a child process with suspicious characteristics. The child command line contains a combination associated with importing Base64 content, and the spawned executable image name ends with specific reconnaissance or networking utilities. This behavior matters because interactive shells with embedded payload decoding and tool execution are commonly used to stage or run attacker-controlled actions. The detection relies on telemetry that includes the parent command line, the child command line, and the child process image/path.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Suspicious Bad Apples Reverse Shell via socat pty
Suspicious Axios NPM macOS Persistence Masquerading as Apple Service
Suspicious Rclone Exfiltration Masquerading as wininit.exe
Suspicious Executable Running from Public Pictures Directory
Suspicious Python Execution via Renamed Synaptics Binary
Malicious Shell Payload Piped from curl to zsh
Agent Tesla Persistence via Realtek Named Scheduled Task Batch
Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)
Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)
Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image
Pivot detection · T1059.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.