Linux: Shell spawned by rsync without -e flag in command line
Flags rsync/rsyncd spawning a shell when rsync lacks the expected " -e " command-line flag.
- Product
- linux
- Category
- process_creation
- Author
- Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2025-01-18
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where a shell executable (e.g., sh, bash, dash) is launched as a child of rsync (rsync/rsyncd) while the rsync command line does not contain the expected ' -e ' flag. Spawning a shell from a file transfer utility is a strong indicator of misuse, such as remote command execution or exploitation attempts leading to unauthorized actions. It relies on Linux process creation telemetry, specifically parent/child process image paths and command-line content.
Reporting behind it
- sysdig.comhttps://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
- gist.github.comhttps://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Shell spawned by rsync without -e flag in command line"
id: efdf35c0-bca1-4c90-968f-25145d2987fc
status: experimental
description: This rule identifies process creation where a shell executable (e.g., sh, bash, dash) is launched as a child of rsync (rsync/rsyncd) while the rsync command line does not contain the expected ' -e ' flag. Spawning a shell from a file transfer utility is a strong indicator of misuse, such as remote command execution or exploitation attempts leading to unauthorized actions. It relies on Linux process creation telemetry, specifically parent/child process image paths and command-line content.
references:
- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
- https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml
author: Florian Roth, Huntrule Team
date: 2025-01-18
tags:
- attack.execution
- attack.t1059
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /rsync
- /rsyncd
Image|endswith:
- /ash
- /bash
- /csh
- /dash
- /ksh
- /sh
- /tcsh
- /zsh
filter_main_expected:
CommandLine|contains: " -e "
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 297241f3-8108-4b3a-8c15-2dda9f844594
type: derived