huntrule

Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()

Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.

FreeReviewedSigma · High · v3
Product
linux
Category
process_creation
Author
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
Published
2024-09-02
Updated
2026-07-31
AnalysisDetection
title: Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()
id: 9f0aeb2c-1768-41a8-9ce3-be6b60a4df3a
status: test
description: This rule identifies Linux process executions where awk-family binaries are started with a command line containing a BEGIN block that calls system(), and the command line also references common shell binaries. Such behavior can indicate attempts to run arbitrary shell commands from within text-processing utilities, which attackers may use for execution and further escalation. Telemetry required includes Linux process creation events with the process image path and full command line content.
references:
  - https://gtfobins.github.io/gtfobins/awk/#shell
  - https://gtfobins.github.io/gtfobins/gawk/#shell
  - https://gtfobins.github.io/gtfobins/nawk/#shell
  - https://gtfobins.github.io/gtfobins/mawk/#shell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /awk
      - /gawk
      - /mawk
      - /nawk
    CommandLine|contains: BEGIN {system
  selection_cli:
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8c1a5675-cb85-452f-a298-b01b22a51856
    type: derived