Suspicious Commands Linux (via auditd)

title: Suspicious Commands Linux (via auditd)
id: db1c64a6-78c3-538a-a65d-85b5d08d920d
status: stable
description: This rule detects relevant commands frequently related to malware or hacking behavior
references:
    - https://attack.mitre.org/techniques/T1059/004/
    - Internal Research - mostly derived from exploit code including code in MSF
author: Huntrule Team
date: 2026-01-28
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    product: linux
    service: auditd
detection:
    cmd1:
        type: 'EXECVE'
        a0: 'chmod'
        a1: 777
    cmd2:
        type: 'EXECVE'
        a0: 'chmod'
        a1: 'u+s'
    cmd3:
        type: 'EXECVE'
        a0: 'cp'
        a1: '/bin/ksh'
    cmd4:
        type: 'EXECVE'
        a0: 'cp'
        a1: '/bin/sh'
    condition: 1 of cmd*
falsepositives:
    - Unknown
level: medium