Linux: Suspicious Shell Command Execution Indicators in Command Lines

title: "Linux: Suspicious Shell Command Execution Indicators in Command Lines"
id: 4fc4637f-472b-4548-a671-ef2eee13b209
status: test
description: This rule flags command lines on Linux that contain keywords commonly seen in exploit and staging workflows, such as using wget piped to interpreters (perl/sh/bash), running simple HTTP servers, spawning PTYs, or using socat to execute or pivot connections. It also matches patterns for downloading payloads, modifying permissions (chmod and setuid-style changes), redirecting output into system startup files, and executing base64 decoding or other common staging steps. The intent is to highlight potentially malicious shell activity based on text/command-line telemetry that records the executed command content.
references:
  - https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
  - http://pastebin.com/FtygZ1cg
  - https://artkond.com/2017/03/23/pivoting-guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shell_susp_commands.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-21
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
detection:
  keywords:
    - wget * - http* | perl
    - wget * - http* | sh
    - wget * - http* | bash
    - python -m SimpleHTTPServer
    - -m http.server
    - import pty; pty.spawn*
    - socat exec:*
    - socat -O /tmp/*
    - socat tcp-connect*
    - "*echo binary >>*"
    - "*wget *; chmod +x*"
    - "*wget *; chmod 777 *"
    - "*cd /tmp || cd /var/run || cd /mnt*"
    - "*stop;service iptables stop;*"
    - "*stop;SuSEfirewall2 stop;*"
    - chmod 777 2020*
    - "*>>/etc/rc.local"
    - "*base64 -d /tmp/*"
    - "* | base64 -d *"
    - "*/chmod u+s *"
    - "*chmod +s /tmp/*"
    - "*chmod u+s /tmp/*"
    - "* /tmp/haxhax*"
    - "* /tmp/ns_sploit*"
    - nc -l -p *
    - cp /bin/ksh *
    - cp /bin/sh *
    - "* /tmp/*.b64 *"
    - "*/tmp/ysocereal.jar*"
    - "*/tmp/x *"
    - "*; chmod +x /tmp/*"
    - "*;chmod +x /tmp/*"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695
    type: derived