Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-03-14
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creation events where an interactive Bash session (bash -i) spawns a child process with suspicious characteristics. The child command line contains a combination associated with importing Base64 content, and the spawned executable image name ends with specific reconnaissance or networking utilities. This behavior matters because interactive shells with embedded payload decoding and tool execution are commonly used to stage or run attacker-controlled actions. The detection relies on telemetry that includes the parent command line, the child command line, and the child process image/path.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Suspicious Executable Running from Public Pictures Directory

Suspicious Python Execution via Renamed Synaptics Binary

Malicious Shell Payload Piped from curl to zsh

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Pivot detection · T1059.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-interactive-bash-launching-suspicious-child-commands-ea3ecad2

title: "Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image"
id: 806b2ece-5403-4338-9405-0fb4b1a89110
status: test
description: This rule flags Linux process creation events where an interactive Bash session (bash -i) spawns a child process with suspicious characteristics. The child command line contains a combination associated with importing Base64 content, and the spawned executable image name ends with specific reconnaissance or networking utilities. This behavior matters because interactive shells with embedded payload decoding and tool execution are commonly used to stage or run attacker-controlled actions. The detection relies on telemetry that includes the parent command line, the child command line, and the child process image/path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-14
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1036
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentCommandLine: bash -i
  anomaly1:
    CommandLine|contains:
      - "-c import "
      - base64
      - pty.spawn
  anomaly2:
    Image|endswith:
      - whoami
      - iptables
      - /ncat
      - /nc
      - /netcat
  condition: selection and 1 of anomaly*
falsepositives:
  - Legitimate software that uses these patterns
level: medium
license: DRL-1.1
related:
  - id: ea3ecad2-db86-4a89-ad0b-132a10d2db55
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL