Detection rules › Splunk
Rare shell script execution
Unix shell scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Linux | auditd SYSCALL record: System call event information |
Rule body
id: '8398.10541'
title: Rare shell script execution
description: 'Unix shell scripts that enable sequential execution of commands as well
as other typical programming operations such as conditionals and loops. - Threat
Actor Association: AbcBot, Sandworm (UAC-0165), TeamTNT, Teal Kurma (aka Sea Turtle,
Marbled Dust, Cosmic Wolf), UNC5221, UTA0178, WatchDog, Winnti Group - Software
Association: Mélofée'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type=SYSCALL ".sh" | table _time,
host, user process*, comm | bin span=1s | stats values(*) as * by _time, host |
eventstats c(comm) as c_comm by comm | where c_comm < 5 and match(comm, "(?i)\.sh") '
techniques:
- execution:command and scripting interpreter:unix shell
technique_id:
- T1059.004
data_category:
- Linux audit logs
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_unix` type=SYSCALL ".sh"
Stage 2: table
| table _time, host, user process*, comm
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: eventstats
| eventstats c(comm) as c_comm by comm
Stage 6: where
| where c_comm < 5 and match(comm, "(?i)\.sh")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
c_comm | lt |
| field:"c_comm" kind:lt value:"5" |
comm | regex_match |
| field:"comm" kind:regex_match |
type | eq |
| field:"type" kind:eq value:"SYSCALL" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | ".sh" |