Linux Process Creating xterm Reverse Shell Display Tunneling

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process executions where the binary path or name contains "xterm" and the command line includes "-display" with a target ending in ":1". Attackers may use xterm with display forwarding/tunneling to establish or interact with a remote shell pathway. The detection relies on process creation telemetry, specifically the Image field and the full CommandLine content.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Suspicious Python Execution via Renamed Synaptics Binary

MSBuild Executing Non-Project File or Remote Payload

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Craft CMS RCE via Query-String CLI Option Injection

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)

Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318

Possible Oracle Opera CGI Webshell Command Execution via operabin

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Linux Process Creating xterm Reverse Shell Display Tunneling

Pivot detection · T1059 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-execution-using-xterm-with-display-1-reverse-shell-indicator-4e25af4b

title: Linux Process Creating xterm Reverse Shell Display Tunneling
id: 8efdeb72-e35b-41b9-b1bf-292cce22f70a
status: test
description: This rule flags Linux process executions where the binary path or name contains "xterm" and the command line includes "-display" with a target ending in ":1". Attackers may use xterm with display forwarding/tunneling to establish or interact with a remote shell pathway. The detection relies on process creation telemetry, specifically the Image field and the full CommandLine content.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-24
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: xterm
    CommandLine|contains: -display
    CommandLine|endswith: :1
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4e25af4b-246d-44ea-8563-e42aacab006b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL