Linux rsync Used with -e to Spawn a Shell

Alerts when rsync is run with -e to execute a shell interpreter on Linux.

FreeUnreviewedSigmahighv1

linux-rsync-used-with-e-to-spawn-a-shell-e2326866

title: Linux rsync Used with -e to Spawn a Shell
id: a9c8787b-95b7-4710-83a0-5c8578f1bcd5
status: experimental
description: This rule flags process executions where rsync is invoked with an embedded command using the -e option, indicating an attempt to run a shell. Such activity can enable unauthorized command execution, privilege escalation, or bypassing command restrictions by leveraging rsync’s command execution capability. It relies on Linux process creation telemetry, matching rsync binary paths and command lines that include " -e " and shell-interpreter strings (e.g., /bin/sh, bash, zsh).
references:
  - https://gtfobins.github.io/gtfobins/rsync/#shell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule Team
date: 2024-09-02
modified: 2025-01-18
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /rsync
      - /rsyncd
    CommandLine|contains: " -e "
  selection_cli:
    CommandLine|contains:
      - "/ash "
      - "/bash "
      - "/dash "
      - "/csh "
      - "/sh "
      - "/zsh "
      - "/tcsh "
      - "/ksh "
      - "'ash "
      - "'bash "
      - "'dash "
      - "'csh "
      - "'sh "
      - "'zsh "
      - "'tcsh "
      - "'ksh "
  condition: all of selection_*
falsepositives:
  - Legitimate cases in which "rsync" is used to execute a shell
level: high
license: DRL-1.1
related:
  - id: e2326866-609f-4015-aea9-7ec634e8aa04
    type: derived

What it detects

This rule flags process executions where rsync is invoked with an embedded command using the -e option, indicating an attempt to run a shell. Such activity can enable unauthorized command execution, privilege escalation, or bypassing command restrictions by leveraging rsync’s command execution capability. It relies on Linux process creation telemetry, matching rsync binary paths and command lines that include " -e " and shell-interpreter strings (e.g., /bin/sh, bash, zsh).

Known false positives

Legitimate cases in which "rsync" is used to execute a shell

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.