Detection rules › Sigma
Interactive Bash Suspicious Children
Detects suspicious interactive bash as a parent to rather uncommon child processes
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.004 Command and Scripting Interpreter: Unix Shell |
| Stealth | T1036 Masquerading |
Event coverage
| Provider | Event |
|---|---|
| Sysmon-for-Linux | Event ID 1 |
Rule body yaml
title: Interactive Bash Suspicious Children
id: ea3ecad2-db86-4a89-ad0b-132a10d2db55
status: test
description: Detects suspicious interactive bash as a parent to rather uncommon child processes
references:
- Internal Research
author: Florian Roth (Nextron Systems)
date: 2022-03-14
tags:
- attack.execution
- attack.stealth
- attack.t1059.004
- attack.t1036
logsource:
product: linux
category: process_creation
detection:
selection:
ParentCommandLine: 'bash -i'
anomaly1:
CommandLine|contains:
- '-c import '
- 'base64'
- 'pty.spawn'
anomaly2:
Image|endswith:
- 'whoami'
- 'iptables'
- '/ncat'
- '/nc'
- '/netcat'
condition: selection and 1 of anomaly*
falsepositives:
- Legitimate software that uses these patterns
level: medium
Stages and Predicates
Stage 0: condition
selection and 1 of anomaly*Stage 1: selection
selection:
ParentCommandLine: 'bash -i'
Stage 2: anomaly1
anomaly1:
CommandLine|contains:
- '-c import '
- 'base64'
- 'pty.spawn'
Stage 3: anomaly2
anomaly2:
Image|endswith:
- 'whoami'
- 'iptables'
- '/ncat'
- '/nc'
- '/netcat'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
ParentCommandLine | eq |
|