Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
Detects suspicious Vim/vi/vimdiff/rvim invocations that include Ex commands to run shell/proxy actions.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Luc Génaux (SigmaHQ), DRL 1.1
- Published
- 2022-12-28
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions where the command line indicates invoking vi/vim and related binaries (including rvim and vimdiff) along with arguments suggesting shell/proxy command execution. It also matches common ex-mode escape patterns that can be used to spawn shells or run embedded commands (e.g., ex commands that execute system commands or script engines). Such activity matters because it can enable unauthorized command execution or escape restricted environments; telemetry relies on process creation events with accurate Image and CommandLine fields.
Reporting behind it
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/vi/
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/vim/
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/rvim/
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/vimdiff/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
id: ea20d986-e27d-4619-a240-bba4c78d82ea
status: test
description: This rule flags Linux process executions where the command line indicates invoking vi/vim and related binaries (including rvim and vimdiff) along with arguments suggesting shell/proxy command execution. It also matches common ex-mode escape patterns that can be used to spawn shells or run embedded commands (e.g., ex commands that execute system commands or script engines). Such activity matters because it can enable unauthorized command execution or escape restricted environments; telemetry relies on process creation events with accurate Image and CommandLine fields.
references:
- https://gtfobins.github.io/gtfobins/vi/
- https://gtfobins.github.io/gtfobins/vim/
- https://gtfobins.github.io/gtfobins/rvim/
- https://gtfobins.github.io/gtfobins/vimdiff/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux, Huntrule Team
date: 2022-12-28
modified: 2026-06-05
tags:
- attack.execution
- attack.discovery
- attack.t1059
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /rvim
- /vi
- /vim
- /vimdiff
CommandLine|contains:
- " --cmd "
- " -c"
selection_cli:
CommandLine|contains:
- :!/
- :!$
- :!..
- ":lua "
- ":py "
- :shell
- /bin/bash
- /bin/dash
- /bin/fish
- /bin/sh
- /bin/csh
- /bin/ksh
- /bin/zsh
- /bin/tmux
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
type: derived