{"id":"700fb7e8-2981-401c-8430-be58e189e741","title":"Suspicious Package Installed - Linux","description":"Detects installation of suspicious packages using system installation utilities","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-03","modified":"2026-01-01","tags":["attack.defense-impairment","attack.t1553.004"],"technique_ids":["T1553.004"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate administration activities"],"references":["https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt"],"source_path":"rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml","source_sha256":"d12e6bc0d1c32b78c57b57c1237c025a8dbf88f728dde760a1ed2575e0ee2bdb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Package Installed - Linux\nid: 700fb7e8-2981-401c-8430-be58e189e741\nstatus: test\ndescription: Detects installation of suspicious packages using system installation utilities\nreferences:\n    - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-03\nmodified: 2026-01-01\ntags:\n    - attack.defense-impairment\n    - attack.t1553.004\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_tool_apt:\n        Image|endswith:\n            - '/apt'\n            - '/apt-get'\n        CommandLine|contains: 'install'\n    selection_tool_yum:\n        Image|endswith: '/yum'\n        CommandLine|contains:\n            - 'localinstall'\n            - 'install'\n    selection_tool_rpm:\n        Image|endswith: '/rpm'\n        CommandLine|contains: '-i'\n    selection_tool_dpkg:\n        Image|endswith: '/dpkg'\n        CommandLine|contains:\n            - '--install'\n            - '-i'\n    selection_keyword:\n        CommandLine|contains:\n            # Add more suspicious packages\n            - 'nmap'\n            - ' nc'\n            - 'netcat'\n            - 'wireshark'\n            - 'tshark'\n            - 'openconnect'\n            - 'proxychains'\n            - 'socat'\n    condition: 1 of selection_tool_* and selection_keyword\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1553.004","id":"T1553.004","name":"Install Root Certificate","page":"techniques/enterprise/T1553.004/"}],"data_path":"data/detection-rules/700fb7e8-2981-401c-8430-be58e189e741.json","kind":"sigma"}