Linux Suspicious Shell Command Piped into Another Shell

Flags Linux processes that start with sh/bash -c and pipe execution into a subsequent shell.

FreeUnreviewedSigmamediumv1

linux-suspicious-shell-command-piped-into-another-shell-880973f3

title: Linux Suspicious Shell Command Piped into Another Shell
id: 71bad6b0-f3e0-43b9-96ba-44336c4c8502
status: test
description: This rule identifies Linux process executions where a command line starts with a shell wrapper ("sh -c" or "bash -c") and includes pipe syntax that invokes another shell at the end or within the piped segment. Piping one shell into another can be used to chain execution stages, making attacker behavior harder to interpret. It relies on process creation telemetry with a CommandLine field to match the specified prefixes and pipe patterns.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-14
modified: 2022-07-26
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|startswith:
      - "sh -c "
      - "bash -c "
  selection_exec:
    - CommandLine|contains:
        - "| bash "
        - "| sh "
        - "|bash "
        - "|sh "
    - CommandLine|endswith:
        - "| bash"
        - "| sh"
        - "|bash"
        - " |sh"
  condition: all of selection*
falsepositives:
  - Legitimate software that uses these patterns
level: medium
license: DRL-1.1
related:
  - id: 880973f3-9708-491c-a77b-2a35a1921158
    type: derived

What it detects

This rule identifies Linux process executions where a command line starts with a shell wrapper ("sh -c" or "bash -c") and includes pipe syntax that invokes another shell at the end or within the piped segment. Piping one shell into another can be used to chain execution stages, making attacker behavior harder to interpret. It relies on process creation telemetry with a CommandLine field to match the specified prefixes and pipe patterns.

Known false positives

Legitimate software that uses these patterns

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.