{"id":"4e25af4b-246d-44ea-8563-e42aacab006b","title":"Potential Xterm Reverse Shell","description":"Detects usage of \"xterm\" as a potential reverse shell tunnel","author":"@d4ns4n_","status":"test","level":"medium","date":"2023-04-24","modified":"","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Unknown"],"references":["https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet","https://www.revshells.com/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml","source_sha256":"55ba59266fd999b66280c5b6848f0598280ac2cd5a39ae0229c762a898a7524e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Xterm Reverse Shell\nid: 4e25af4b-246d-44ea-8563-e42aacab006b\nstatus: test\ndescription: Detects usage of \"xterm\" as a potential reverse shell tunnel\nreferences:\n    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n    - https://www.revshells.com/\nauthor: '@d4ns4n_'\ndate: 2023-04-24\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|contains: 'xterm'\n        CommandLine|contains: '-display'\n        CommandLine|endswith: ':1'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/4e25af4b-246d-44ea-8563-e42aacab006b.json","kind":"sigma"}