Suspicious Package Installed - Linux

Title: Suspicious Package Installed - Linux
Status: test
Description:Detects installation of suspicious packages using system installation utilities
References:
  -https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
modified:2026-01-01
Tags:

• -'attack.defense-impairment'
• -'attack.t1553.004'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection_tool_apt:
    Image|endswith:
      -'/apt'
      -'/apt-get'

    CommandLine|contains: 'install'
  selection_tool_yum:
    Image|endswith: '/yum'
    CommandLine|contains:
      -'localinstall'
      -'install'

  selection_tool_rpm:
    Image|endswith: '/rpm'
    CommandLine|contains: '-i'
  selection_tool_dpkg:
    Image|endswith: '/dpkg'
    CommandLine|contains:
      -'--install'
      -'-i'

  selection_keyword:
    CommandLine|contains:
      -'nmap'
      -' nc'
      -'netcat'
      -'wireshark'
      -'tshark'
      -'openconnect'
      -'proxychains'
      -'socat'

  condition:1 of selection_tool_* and selection_keyword
Falsepositives:
  -Legitimate administration activities
Level: medium