huntrule

Linux process execution matches known hacktools by image name

Alerts on Linux process executions of known hacktool, scanner, web enumeration, and exploit utility binaries by image name.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]) (SigmaHQ), DRL 1.1
Published
2023-01-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Resource Dev

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where the executable image name matches a set of known hacktool, exploitation, scanning, and enumeration tool paths. Attackers often use these tools to execute credential attacks, framework components, reconnaissance, and vulnerability probing, making their presence in process telemetry a strong lead. It relies on process creation logs that include the process image path or name to match known suffixes and substrings.

Reporting behind it

Related detections5 linkedT1587 — drag to rearrange
Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll
Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation
Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation
Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata
Linux Auditd: Program Executions from Suspicious Web and Data Directories
Linux process execution matches known hacktools by image name
Pivot detection · T1587 · 5 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.