Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

FreeReviewedSigma · High · v2

Product: linux
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-20
Updated: 2026-07-31

ATT&CK techniques

Recon → Cred Access

Recon
- T1592.004Client Configurations
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Linux process creation events where the command line contains patterns commonly used to locate sensitive files during reconnaissance, including searching for a .htpasswd filename and files with the setuid bit (-perm -4000). Attackers often use these queries to identify credential-related artifacts and misconfigurations before exploitation. Detection relies on process creation telemetry that includes the full command line.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-recon-command-line-indicators-for-suid-htpasswd-discovery-0cf7a157

title: "Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns"
id: 645905c5-5219-42c9-8df3-568999677483
status: test
description: This rule matches Linux process creation events where the command line contains patterns commonly used to locate sensitive files during reconnaissance, including searching for a .htpasswd filename and files with the setuid bit (-perm -4000). Attackers often use these queries to identify credential-related artifacts and misconfigurations before exploitation. Detection relies on process creation telemetry that includes the full command line.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
tags:
  - attack.reconnaissance
  - attack.t1592.004
  - attack.credential-access
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - " -name .htpasswd"
      - " -perm -4000 "
  condition: selection
falsepositives:
  - Legitimate administration activities
level: high
license: DRL-1.1
related:
  - id: 0cf7a157-8879-41a2-8f55-388dd23746b7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL