Sigma rule: Suspicious Activity in Shell Commands

Rule

Title

Suspicious Activity in Shell Commands

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2017-08-21

Modified

2021-11-27

File

rules/linux/builtin/lnx_shell_susp_commands.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious shell commands used in various exploit codes (see references)

Log source

product

linux

Detection

keywords:
    # Generic suspicious commands
    - 'wget * - http* | perl'
    - 'wget * - http* | sh'
    - 'wget * - http* | bash'
    - 'python -m SimpleHTTPServer'
    - '-m http.server'      # Python 3
    - 'import pty; pty.spawn*'
    - 'socat exec:*'
    - 'socat -O /tmp/*'
    - 'socat tcp-connect*'
    - '*echo binary >>*'
    # Malware
    - '*wget *; chmod +x*'
    - '*wget *; chmod 777 *'
    - '*cd /tmp || cd /var/run || cd /mnt*'
    # Apache Struts in-the-wild exploit codes
    - '*stop;service iptables stop;*'
    - '*stop;SuSEfirewall2 stop;*'
    - 'chmod 777 2020*'
    - '*>>/etc/rc.local'
    # Metasploit framework exploit codes
    - '*base64 -d /tmp/*'
    - '* | base64 -d *'
    - '*/chmod u+s *'
    - '*chmod +s /tmp/*'
    - '*chmod u+s /tmp/*'
    - '* /tmp/haxhax*'
    - '* /tmp/ns_sploit*'
    - 'nc -l -p *'
    - 'cp /bin/ksh *'
    - 'cp /bin/sh *'
    - '* /tmp/*.b64 *'
    - '*/tmp/ysocereal.jar*'
    - '*/tmp/x *'
    - '*; chmod +x /tmp/*'
    - '*;chmod +x /tmp/*'
condition: keywords

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.004

MITRE ATT&CK ids this rule names

• T1059.004

References

• https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html
• https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
• http://pastebin.com/FtygZ1cg
• https://artkond.com/2017/03/23/pivoting-guide/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/builtin/lnx_shell_susp_commands.yml