huntrule

Linux Process Execution via apt/apt-get Shell Proxy Option

Detects apt/apt-get executions using APT::Update::Pre-Invoke to trigger shell-like command execution.

FreeUnreviewedSigmamediumv1
title: Linux Process Execution via apt/apt-get Shell Proxy Option
id: 6811f046-7865-42b8-a742-e3faaf14a7bf
status: test
description: This rule flags Linux process executions where the binary path ends with /apt or /apt-get and the command line includes the APT::Update::Pre-Invoke option. Attackers can use this apt configuration hook to run arbitrary commands or proxy execution during package update workflows. The detection relies on process creation telemetry with executable path and command-line arguments.
references:
  - https://gtfobins.github.io/gtfobins/apt/
  - https://gtfobins.github.io/gtfobins/apt-get/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
modified: 2024-09-02
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /apt
      - /apt-get
    CommandLine|contains: APT::Update::Pre-Invoke::=
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bb382fd5-b454-47ea-a264-1828e4c766d6
    type: derived

What it detects

This rule flags Linux process executions where the binary path ends with /apt or /apt-get and the command line includes the APT::Update::Pre-Invoke option. Attackers can use this apt configuration hook to run arbitrary commands or proxy execution during package update workflows. The detection relies on process creation telemetry with executable path and command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.