Linux Recon Command-Line Indicators for SUID/htpasswd Discovery

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

FreeUnreviewedSigmahighv1

linux-recon-command-line-indicators-for-suid-htpasswd-discovery-0cf7a157

title: Linux Recon Command-Line Indicators for SUID/htpasswd Discovery
id: 645905c5-5219-42c9-8df3-568999677483
status: test
description: "This rule identifies Linux process creation events whose command lines include specific reconnaissance-related patterns: searching for files named .htpasswd and querying for files with the setuid bit (-perm -4000). Attackers commonly use these checks to locate exposed credential artifacts and identify privilege-escalation opportunities during recon. Detection relies on process execution telemetry with command-line strings and matches exact substring patterns within the CommandLine field."
references:
  - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
tags:
  - attack.reconnaissance
  - attack.t1592.004
  - attack.credential-access
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - " -name .htpasswd"
      - " -perm -4000 "
  condition: selection
falsepositives:
  - Legitimate administration activities
level: high
license: DRL-1.1
related:
  - id: 0cf7a157-8879-41a2-8f55-388dd23746b7
    type: derived

What it detects

This rule identifies Linux process creation events whose command lines include specific reconnaissance-related patterns: searching for files named .htpasswd and querying for files with the setuid bit (-perm -4000). Attackers commonly use these checks to locate exposed credential artifacts and identify privilege-escalation opportunities during recon. Detection relies on process execution telemetry with command-line strings and matches exact substring patterns within the CommandLine field.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.