Linux Process Creation: Shell Command Piped Into Another Shell

Flags Linux processes that start with sh/bash -c and pipe execution into a subsequent shell.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-03-14
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux processes whose command line begins with a shell wrapper (sh -c or bash -c) and includes piping that results in execution by another shell. Attackers commonly use this chaining to execute staged commands while preserving interactive or script-driven behavior across multiple shells. The detection relies on process creation telemetry capturing the full CommandLine for the spawned process.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang

Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

Suspicious Python Inline Deobfuscation and Execution One-Liner

Suspicious Base64 Decoded Payload Piped to Shell on Linux

Suspicious Remote File Download via certutil URLCache (via process_creation)

Malicious certutil Decodehex Payload Reconstruction by DarkGate

Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)

Linux Process Creation: Shell Command Piped Into Another Shell

Pivot detection · T1140 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-shell-command-piped-into-another-shell-880973f3

title: "Linux Process Creation: Shell Command Piped Into Another Shell"
id: 71bad6b0-f3e0-43b9-96ba-44336c4c8502
status: test
description: This rule flags Linux processes whose command line begins with a shell wrapper (sh -c or bash -c) and includes piping that results in execution by another shell. Attackers commonly use this chaining to execute staged commands while preserving interactive or script-driven behavior across multiple shells. The detection relies on process creation telemetry capturing the full CommandLine for the spawned process.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-14
modified: 2022-07-26
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|startswith:
      - "sh -c "
      - "bash -c "
  selection_exec:
    - CommandLine|contains:
        - "| bash "
        - "| sh "
        - "|bash "
        - "|sh "
    - CommandLine|endswith:
        - "| bash"
        - "| sh"
        - "|bash"
        - " |sh"
  condition: all of selection*
falsepositives:
  - Legitimate software that uses these patterns
level: medium
license: DRL-1.1
related:
  - id: 880973f3-9708-491c-a77b-2a35a1921158
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL