Linux Process Execution Using xterm With -display :1 Reverse Shell Indicator

title: Linux Process Execution Using xterm With -display :1 Reverse Shell Indicator
id: 8efdeb72-e35b-41b9-b1bf-292cce22f70a
status: test
description: This rule flags Linux process creation where the executable path contains "xterm" and the command line includes "-display" and ends with ":1", a pattern consistent with an xterm-based reverse shell tunnel. Attackers may use xterm display redirection to establish a remote interactive session while blending in with normal terminal tooling. The detection relies on process creation telemetry capturing both the process image string and the full command line parameters.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-24
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: xterm
    CommandLine|contains: -display
    CommandLine|endswith: :1
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4e25af4b-246d-44ea-8563-e42aacab006b
    type: derived