Sigma rule: Suspicious Invocation of Shell via Rsync

Rule

Title

Suspicious Invocation of Shell via Rsync

Status

experimental

Level

high

Author

Florian Roth

Date

2025-01-18

File

rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Log source

product

linux

category

process_creation

Detection

selection:
    ParentImage|endswith:
        - '/rsync'
        - '/rsyncd'
    Image|endswith:
        - '/ash'
        - '/bash'
        - '/csh'
        - '/dash'
        - '/ksh'
        - '/sh'
        - '/tcsh'
        - '/zsh'
filter_main_expected:
    CommandLine|contains: ' -e '
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059
• attack.t1203

MITRE ATT&CK ids this rule names

• T1059
• T1203

References

• https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
• https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml