Linux: Shell Execution Using nice Utility

title: "Linux: Shell Execution Using nice Utility"
id: c8412364-8340-4a70-ad95-be156c22b0cc
status: test
description: This rule identifies process executions of the nice utility where the command line ends with a shell path such as /bin/bash, /bin/dash, /bin/fish, /bin/sh, or /bin/zsh. Attackers may use nice to launch a shell to run unauthorized commands, escalate privileges, or bypass restricted execution environments. The detection relies on Linux process creation telemetry capturing the executing image path and the full command line.
references:
  - https://gtfobins.github.io/gtfobins/nice/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /nice
    CommandLine|endswith:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 093d68c7-762a-42f4-9f46-95e79142571a
    type: derived