Linux Shell Pipe to Shell

Title: Linux Shell Pipe to Shell
Status: test
Description:Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2022-03-14
modified:2022-07-26
Tags:

• -'attack.stealth'
• -'attack.t1140'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    CommandLine|startswith:
      -'sh -c '
      -'bash -c '

  selection_exec:
    - CommandLine|contains:
      - '| bash '
      - '| sh '
      - '|bash '
      - '|sh '
    - CommandLine|endswith:
      - '| bash'
      - '| sh'
      - '|bash'
      - ' |sh'
  condition:all of selection*
Falsepositives:
  -Legitimate software that uses these patterns
Level: medium