Linux process-created writes to sensitive or critical files via shell redirection or editors
Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_ (Wuerth-Phoenix) (SigmaHQ), DRL 1.1
- Published
- 2023-05-30
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Linux process executions whose command lines indicate writing or inspecting output with redirection operators (e.g., using cat/echo/grep/head/more/tail with '>') and related editor usage (emacs/nano/sed/vi/vim), combined with targeting sensitive or critical paths such as login/passwd, cron configuration, sudoers, hosts, init scripts, and system/application directories. Such activity can indicate an attacker modifying high-value files to maintain persistence, escalate privileges, or disrupt system operation. It relies on process creation telemetry including the executing image name and full command line content, plus file-path substrings, and it excludes a specific mdadm.conf sed modification pattern.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux process-created writes to sensitive or critical files via shell redirection or editors
id: 793eca42-de19-4bd4-a3c6-a9c51cc76957
status: test
description: This rule flags Linux process executions whose command lines indicate writing or inspecting output with redirection operators (e.g., using cat/echo/grep/head/more/tail with '>') and related editor usage (emacs/nano/sed/vi/vim), combined with targeting sensitive or critical paths such as login/passwd, cron configuration, sudoers, hosts, init scripts, and system/application directories. Such activity can indicate an attacker modifying high-value files to maintain persistence, escalate privileges, or disrupt system operation. It relies on process creation telemetry including the executing image name and full command line content, plus file-path substrings, and it excludes a specific mdadm.conf sed modification pattern.
references:
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml
author: "@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"
date: 2023-05-30
modified: 2026-03-18
tags:
- attack.impact
- attack.t1565.001
logsource:
category: process_creation
product: linux
detection:
selection_img_1:
Image|endswith:
- /cat
- /echo
- /grep
- /head
- /more
- /tail
CommandLine|contains: ">"
selection_img_2:
Image|endswith:
- /emacs
- /nano
- /sed
- /vi
- /vim
selection_paths:
CommandLine|contains:
- /bin/login
- /bin/passwd
- /boot/
- /etc/*.conf
- /etc/cron.
- /etc/crontab
- /etc/hosts
- /etc/init.d
- /etc/sudoers
- /opt/bin/
- /sbin
- /usr/bin/
- /usr/local/bin/
filter_main_mdadm.conf:
Image|endswith: /bin/sed
CommandLine|startswith:
- sed -i /^*
- sed -ne s/^
CommandLine|endswith: /etc/mdadm/mdadm.conf
condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*
falsepositives:
- Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.
level: medium
license: DRL-1.1
related:
- id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4
type: derived