huntrule

Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-03-14
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where an interactive Bash session (bash -i) spawns a child process with suspicious characteristics. The child command line contains a combination associated with importing Base64 content, and the spawned executable image name ends with specific reconnaissance or networking utilities. This behavior matters because interactive shells with embedded payload decoding and tool execution are commonly used to stage or run attacker-controlled actions. The detection relies on telemetry that includes the parent command line, the child command line, and the child process image/path.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange
Possible Remote Payload Download And Execution via Shell (via process_creation)
Suspicious GitHub Actions Runner In Hidden Directory via Shell (via process_creation)
Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)
Malicious EtherRAT Base64 Decoded Payload Piped To Bash via Shell (via process_creation)
Suspicious Billbug Loader Artifacts in Windows Temp Directory
Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)
Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)
Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image
Pivot detection · T1036 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.