Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where rsync is invoked with command-line arguments indicating shell execution (using the -e option) and where the command targets common shell binaries. Attackers may use this to run arbitrary commands, potentially to escalate privileges or escape restricted environments. Telemetry required includes Linux process creation events with process image path and full command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: rsync Used to Spawn a Shell via Command-Line -e"
id: a9c8787b-95b7-4710-83a0-5c8578f1bcd5
status: experimental
description: This rule flags process executions where rsync is invoked with command-line arguments indicating shell execution (using the -e option) and where the command targets common shell binaries. Attackers may use this to run arbitrary commands, potentially to escalate privileges or escape restricted environments. Telemetry required includes Linux process creation events with process image path and full command-line arguments.
references:
- https://gtfobins.github.io/gtfobins/rsync/#shell
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule Team
date: 2024-09-02
modified: 2025-01-18
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /rsync
- /rsyncd
CommandLine|contains: " -e "
selection_cli:
CommandLine|contains:
- "/ash "
- "/bash "
- "/dash "
- "/csh "
- "/sh "
- "/zsh "
- "/tcsh "
- "/ksh "
- "'ash "
- "'bash "
- "'dash "
- "'csh "
- "'sh "
- "'zsh "
- "'tcsh "
- "'ksh "
condition: all of selection_*
falsepositives:
- Legitimate cases in which "rsync" is used to execute a shell
level: high
license: DRL-1.1
related:
- id: e2326866-609f-4015-aea9-7ec634e8aa04
type: derived