huntrule

Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes

Detects suspicious Vim/vi/vimdiff/rvim invocations that include Ex commands to run shell/proxy actions.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), Luc Génaux (SigmaHQ), DRL 1.1
Published
2022-12-28
Updated
2026-07-31
AnalysisDetection
title: Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
id: ea20d986-e27d-4619-a240-bba4c78d82ea
status: test
description: This rule flags Linux process executions where the command line indicates invoking vi/vim and related binaries (including rvim and vimdiff) along with arguments suggesting shell/proxy command execution. It also matches common ex-mode escape patterns that can be used to spawn shells or run embedded commands (e.g., ex commands that execute system commands or script engines). Such activity matters because it can enable unauthorized command execution or escape restricted environments; telemetry relies on process creation events with accurate Image and CommandLine fields.
references:
  - https://gtfobins.github.io/gtfobins/vi/
  - https://gtfobins.github.io/gtfobins/vim/
  - https://gtfobins.github.io/gtfobins/rvim/
  - https://gtfobins.github.io/gtfobins/vimdiff/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux, Huntrule Team
date: 2022-12-28
modified: 2026-06-05
tags:
  - attack.execution
  - attack.discovery
  - attack.t1059
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /rvim
      - /vi
      - /vim
      - /vimdiff
    CommandLine|contains:
      - " --cmd "
      - " -c"
  selection_cli:
    CommandLine|contains:
      - :!/
      - :!$
      - :!..
      - ":lua "
      - ":py "
      - :shell
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/csh
      - /bin/ksh
      - /bin/zsh
      - /bin/tmux
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
    type: derived