huntrule

Linux: rsync Used to Spawn a Shell via Command-Line -e

Alerts when rsync is run with -e to execute a shell interpreter on Linux.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth (SigmaHQ), DRL 1.1
Published
2024-09-02
Updated
2026-07-31
AnalysisDetection
title: "Linux: rsync Used to Spawn a Shell via Command-Line -e"
id: a9c8787b-95b7-4710-83a0-5c8578f1bcd5
status: experimental
description: This rule flags process executions where rsync is invoked with command-line arguments indicating shell execution (using the -e option) and where the command targets common shell binaries. Attackers may use this to run arbitrary commands, potentially to escalate privileges or escape restricted environments. Telemetry required includes Linux process creation events with process image path and full command-line arguments.
references:
  - https://gtfobins.github.io/gtfobins/rsync/#shell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule Team
date: 2024-09-02
modified: 2025-01-18
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /rsync
      - /rsyncd
    CommandLine|contains: " -e "
  selection_cli:
    CommandLine|contains:
      - "/ash "
      - "/bash "
      - "/dash "
      - "/csh "
      - "/sh "
      - "/zsh "
      - "/tcsh "
      - "/ksh "
      - "'ash "
      - "'bash "
      - "'dash "
      - "'csh "
      - "'sh "
      - "'zsh "
      - "'tcsh "
      - "'ksh "
  condition: all of selection_*
falsepositives:
  - Legitimate cases in which "rsync" is used to execute a shell
level: high
license: DRL-1.1
related:
  - id: e2326866-609f-4015-aea9-7ec634e8aa04
    type: derived