{"id":"297241f3-8108-4b3a-8c15-2dda9f844594","title":"Suspicious Invocation of Shell via Rsync","description":"Detects the execution of a shell as sub process of \"rsync\" without the expected command line flag \"-e\" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n","author":"Florian Roth","status":"experimental","level":"high","date":"2025-01-18","modified":"","tags":["attack.execution","attack.t1059","attack.t1203"],"technique_ids":["T1059","T1203"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Unknown"],"references":["https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/","https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10"],"source_path":"rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml","source_sha256":"ad3747262590f4b5ecaf83e96dfd590c9c39caf73387629fd2abcf87eda16a1f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Invocation of Shell via Rsync\nid: 297241f3-8108-4b3a-8c15-2dda9f844594\nstatus: experimental\ndescription: |\n    Detects the execution of a shell as sub process of \"rsync\" without the expected command line flag \"-e\" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\nreferences:\n    - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/\n    - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10\nauthor: Florian Roth\ndate: 2025-01-18\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.t1203\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        ParentImage|endswith:\n            - '/rsync'\n            - '/rsyncd'\n        Image|endswith:\n            - '/ash'\n            - '/bash'\n            - '/csh'\n            - '/dash'\n            - '/ksh'\n            - '/sh'\n            - '/tcsh'\n            - '/zsh'\n    filter_main_expected:\n        CommandLine|contains: ' -e '\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/297241f3-8108-4b3a-8c15-2dda9f844594.json","kind":"sigma"}