Linux Process Creation: Shell Command Piped Into Another Shell

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux processes whose command line begins with a shell wrapper (sh -c or bash -c) and includes piping that results in execution by another shell. Attackers commonly use this chaining to execute staged commands while preserving interactive or script-driven behavior across multiple shells. The detection relies on process creation telemetry capturing the full CommandLine for the spawned process.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Hidden PowerShell Archive Extraction via ExtractToDirectory

Malicious Shell Payload Piped from curl to zsh

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

Obfuscated File Decoding via Certutil (via process_creation)

Linux Process Creation: Shell Command Piped Into Another Shell

Pivot detection · T1140 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-shell-command-piped-into-another-shell-880973f3

title: "Linux Process Creation: Shell Command Piped Into Another Shell"
id: 71bad6b0-f3e0-43b9-96ba-44336c4c8502
status: test
description: This rule flags Linux processes whose command line begins with a shell wrapper (sh -c or bash -c) and includes piping that results in execution by another shell. Attackers commonly use this chaining to execute staged commands while preserving interactive or script-driven behavior across multiple shells. The detection relies on process creation telemetry capturing the full CommandLine for the spawned process.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-14
modified: 2022-07-26
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|startswith:
      - "sh -c "
      - "bash -c "
  selection_exec:
    - CommandLine|contains:
        - "| bash "
        - "| sh "
        - "|bash "
        - "|sh "
    - CommandLine|endswith:
        - "| bash"
        - "| sh"
        - "|bash"
        - " |sh"
  condition: all of selection*
falsepositives:
  - Legitimate software that uses these patterns
level: medium
license: DRL-1.1
related:
  - id: 880973f3-9708-491c-a77b-2a35a1921158
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL