{"id":"8c1a5675-cb85-452f-a298-b01b22a51856","title":"Suspicious Invocation of Shell via AWK - Linux","description":"Detects the execution of \"awk\" or it's sibling commands, to invoke a shell using the system() function.\nThis behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":"","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Unknown"],"references":["https://gtfobins.github.io/gtfobins/awk/#shell","https://gtfobins.github.io/gtfobins/gawk/#shell","https://gtfobins.github.io/gtfobins/nawk/#shell","https://gtfobins.github.io/gtfobins/mawk/#shell"],"source_path":"rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml","source_sha256":"e79ec9f19754454997835bf43ca0a28274a5eb9c51642ca54eadaceb292cb32c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Invocation of Shell via AWK - Linux\nid: 8c1a5675-cb85-452f-a298-b01b22a51856\nstatus: test\ndescription: |\n    Detects the execution of \"awk\" or it's sibling commands, to invoke a shell using the system() function.\n    This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\nreferences:\n    - https://gtfobins.github.io/gtfobins/awk/#shell\n    - https://gtfobins.github.io/gtfobins/gawk/#shell\n    - https://gtfobins.github.io/gtfobins/nawk/#shell\n    - https://gtfobins.github.io/gtfobins/mawk/#shell\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith:\n            - '/awk'\n            - '/gawk'\n            - '/mawk'\n            - '/nawk'\n        CommandLine|contains: 'BEGIN {system'\n    selection_cli:\n        CommandLine|contains:\n            - '/bin/bash'\n            - '/bin/dash'\n            - '/bin/fish'\n            - '/bin/sh'\n            - '/bin/zsh'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/8c1a5675-cb85-452f-a298-b01b22a51856.json","kind":"sigma"}