Linux Shell Invocation via awk/gawk/mawk/nawk system() in CommandLine

title: Linux Shell Invocation via awk/gawk/mawk/nawk system() in CommandLine
id: 9f0aeb2c-1768-41a8-9ce3-be6b60a4df3a
status: test
description: This rule flags Linux process executions where awk, gawk, mawk, or nawk are invoked with CommandLine content indicating use of BEGIN { system(...)} to launch a shell. Attackers can use awk’s system() capability to run arbitrary OS commands, often enabling follow-on actions such as credential access or privilege escalation. Telemetry relies on Linux process creation logs containing the executable path suffix (/awk family) and the command line parameters referencing system() and an interactive shell path.
references:
  - https://gtfobins.github.io/gtfobins/awk/#shell
  - https://gtfobins.github.io/gtfobins/gawk/#shell
  - https://gtfobins.github.io/gtfobins/nawk/#shell
  - https://gtfobins.github.io/gtfobins/mawk/#shell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /awk
      - /gawk
      - /mawk
      - /nawk
    CommandLine|contains: BEGIN {system
  selection_cli:
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8c1a5675-cb85-452f-a298-b01b22a51856
    type: derived