Linux process executions editing sensitive or critical files via shell redirection or editor tools

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

FreeUnreviewedSigmamediumv1

linux-process-executions-editing-sensitive-or-critical-files-via-shell-redirecti-86157017

title: Linux process executions editing sensitive or critical files via shell redirection or editor tools
id: 793eca42-de19-4bd4-a3c6-a9c51cc76957
status: test
description: This rule flags Linux process executions where a command-writing utility (such as cat/echo/grep/head/more/tail) uses shell redirection and targets a set of sensitive or critical file paths, or where common editors (emacs/nano/sed/vi/vim) are invoked. The behavior matters because attackers can modify configuration, authentication, boot/cron, and privilege-related files to establish persistence, escalate privileges, or disrupt services. Telemetry relies on process creation fields including process image path and command-line contents for both file-path targeting and redirection/editor invocation patterns.
references:
  - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml
author: "@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"
date: 2023-05-30
modified: 2026-03-18
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_img_1:
    Image|endswith:
      - /cat
      - /echo
      - /grep
      - /head
      - /more
      - /tail
    CommandLine|contains: ">"
  selection_img_2:
    Image|endswith:
      - /emacs
      - /nano
      - /sed
      - /vi
      - /vim
  selection_paths:
    CommandLine|contains:
      - /bin/login
      - /bin/passwd
      - /boot/
      - /etc/*.conf
      - /etc/cron.
      - /etc/crontab
      - /etc/hosts
      - /etc/init.d
      - /etc/sudoers
      - /opt/bin/
      - /sbin
      - /usr/bin/
      - /usr/local/bin/
  filter_main_mdadm.conf:
    Image|endswith: /bin/sed
    CommandLine|startswith:
      - sed -i /^*
      - sed -ne s/^
    CommandLine|endswith: /etc/mdadm/mdadm.conf
  condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*
falsepositives:
  - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.
level: medium
license: DRL-1.1
related:
  - id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4
    type: derived

What it detects

This rule flags Linux process executions where a command-writing utility (such as cat/echo/grep/head/more/tail) uses shell redirection and targets a set of sensitive or critical file paths, or where common editors (emacs/nano/sed/vi/vim) are invoked. The behavior matters because attackers can modify configuration, authentication, boot/cron, and privilege-related files to establish persistence, escalate privileges, or disrupt services. Telemetry relies on process creation fields including process image path and command-line contents for both file-path targeting and redirection/editor invocation patterns.

Known false positives

Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.