Linux process execution via apt/apt-get Pre-Invoke shell command
Detects apt/apt-get executions using APT::Update::Pre-Invoke to trigger shell-like command execution.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-28
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process creation where the executable path ends with /apt or /apt-get and the command line includes APT::Update::Pre-Invoke=. Attackers may use apt’s Pre-Invoke feature to run arbitrary shell or proxy commands during package update workflows, which can help with unauthorized command execution or privilege escalation attempts. It relies on process creation telemetry containing the process image path and full command line.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux process execution via apt/apt-get Pre-Invoke shell command
id: 6811f046-7865-42b8-a742-e3faaf14a7bf
status: test
description: This rule flags Linux process creation where the executable path ends with /apt or /apt-get and the command line includes APT::Update::Pre-Invoke=. Attackers may use apt’s Pre-Invoke feature to run arbitrary shell or proxy commands during package update workflows, which can help with unauthorized command execution or privilege escalation attempts. It relies on process creation telemetry containing the process image path and full command line.
references:
- https://gtfobins.github.io/gtfobins/apt/
- https://gtfobins.github.io/gtfobins/apt-get/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
modified: 2024-09-02
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /apt
- /apt-get
CommandLine|contains: APT::Update::Pre-Invoke::=
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bb382fd5-b454-47ea-a264-1828e4c766d6
type: derived