{"id":"2aa1440c-9ae9-4d92-84a7-a9e5f5e31695","title":"Suspicious Activity in Shell Commands","description":"Detects suspicious shell commands used in various exploit codes (see references)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-08-21","modified":"2021-11-27","tags":["attack.execution","attack.t1059.004"],"technique_ids":["T1059.004"],"logsource":{"product":"linux"},"falsepositives":["Unknown"],"references":["https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html","https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb","http://pastebin.com/FtygZ1cg","https://artkond.com/2017/03/23/pivoting-guide/"],"source_path":"rules/linux/builtin/lnx_shell_susp_commands.yml","source_sha256":"6958c20c0ba481e5fd34cd4a7ee85302a685cba63e985c21f58d5a34101c2663","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_shell_susp_commands.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Activity in Shell Commands\nid: 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695\nstatus: test\ndescription: Detects suspicious shell commands used in various exploit codes (see references)\nreferences:\n    - https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html\n    - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb\n    - http://pastebin.com/FtygZ1cg\n    - https://artkond.com/2017/03/23/pivoting-guide/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-08-21\nmodified: 2021-11-27\ntags:\n    - attack.execution\n    - attack.t1059.004\nlogsource:\n    product: linux\ndetection:\n    keywords:\n        # Generic suspicious commands\n        - 'wget * - http* | perl'\n        - 'wget * - http* | sh'\n        - 'wget * - http* | bash'\n        - 'python -m SimpleHTTPServer'\n        - '-m http.server'      # Python 3\n        - 'import pty; pty.spawn*'\n        - 'socat exec:*'\n        - 'socat -O /tmp/*'\n        - 'socat tcp-connect*'\n        - '*echo binary >>*'\n        # Malware\n        - '*wget *; chmod +x*'\n        - '*wget *; chmod 777 *'\n        - '*cd /tmp || cd /var/run || cd /mnt*'\n        # Apache Struts in-the-wild exploit codes\n        - '*stop;service iptables stop;*'\n        - '*stop;SuSEfirewall2 stop;*'\n        - 'chmod 777 2020*'\n        - '*>>/etc/rc.local'\n        # Metasploit framework exploit codes\n        - '*base64 -d /tmp/*'\n        - '* | base64 -d *'\n        - '*/chmod u+s *'\n        - '*chmod +s /tmp/*'\n        - '*chmod u+s /tmp/*'\n        - '* /tmp/haxhax*'\n        - '* /tmp/ns_sploit*'\n        - 'nc -l -p *'\n        - 'cp /bin/ksh *'\n        - 'cp /bin/sh *'\n        - '* /tmp/*.b64 *'\n        - '*/tmp/ysocereal.jar*'\n        - '*/tmp/x *'\n        - '*; chmod +x /tmp/*'\n        - '*;chmod +x /tmp/*'\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/2aa1440c-9ae9-4d92-84a7-a9e5f5e31695.json","kind":"sigma"}