Linux: Shell spawned by rsync without expected -e flag

title: "Linux: Shell spawned by rsync without expected -e flag"
id: efdf35c0-bca1-4c90-968f-25145d2987fc
status: experimental
description: This rule identifies process creation where the parent process is rsync (rsync or rsyncd) and the child process is a shell binary (e.g., bash/sh/ksh/zsh). It flags cases where the rsync command line does not contain the expected " -e " flag, which can indicate anomalous or abusive execution leading to unauthorized command execution. The detection relies on Linux process creation telemetry, specifically parent/child process image paths and command-line arguments.
references:
  - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
  - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml
author: Florian Roth, Huntrule Team
date: 2025-01-18
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - /rsync
      - /rsyncd
    Image|endswith:
      - /ash
      - /bash
      - /csh
      - /dash
      - /ksh
      - /sh
      - /tcsh
      - /zsh
  filter_main_expected:
    CommandLine|contains: " -e "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 297241f3-8108-4b3a-8c15-2dda9f844594
    type: derived