huntrule

Linux process-created writes to sensitive or critical files via shell redirection or editors

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
@d4ns4n_ (Wuerth-Phoenix) (SigmaHQ), DRL 1.1
Published
2023-05-30
Updated
2026-07-31
AnalysisDetection
title: Linux process-created writes to sensitive or critical files via shell redirection or editors
id: 793eca42-de19-4bd4-a3c6-a9c51cc76957
status: test
description: This rule flags Linux process executions whose command lines indicate writing or inspecting output with redirection operators (e.g., using cat/echo/grep/head/more/tail with '>') and related editor usage (emacs/nano/sed/vi/vim), combined with targeting sensitive or critical paths such as login/passwd, cron configuration, sudoers, hosts, init scripts, and system/application directories. Such activity can indicate an attacker modifying high-value files to maintain persistence, escalate privileges, or disrupt system operation. It relies on process creation telemetry including the executing image name and full command line content, plus file-path substrings, and it excludes a specific mdadm.conf sed modification pattern.
references:
  - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml
author: "@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"
date: 2023-05-30
modified: 2026-03-18
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_img_1:
    Image|endswith:
      - /cat
      - /echo
      - /grep
      - /head
      - /more
      - /tail
    CommandLine|contains: ">"
  selection_img_2:
    Image|endswith:
      - /emacs
      - /nano
      - /sed
      - /vi
      - /vim
  selection_paths:
    CommandLine|contains:
      - /bin/login
      - /bin/passwd
      - /boot/
      - /etc/*.conf
      - /etc/cron.
      - /etc/crontab
      - /etc/hosts
      - /etc/init.d
      - /etc/sudoers
      - /opt/bin/
      - /sbin
      - /usr/bin/
      - /usr/local/bin/
  filter_main_mdadm.conf:
    Image|endswith: /bin/sed
    CommandLine|startswith:
      - sed -i /^*
      - sed -ne s/^
    CommandLine|endswith: /etc/mdadm/mdadm.conf
  condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*
falsepositives:
  - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.
level: medium
license: DRL-1.1
related:
  - id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4
    type: derived