{"id":"a015e032-146d-4717-8944-7a1884122111","title":"Linux HackTool Execution","description":"Detects known hacktool execution based on image name.","author":"Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])","status":"test","level":"high","date":"2023-01-03","modified":"2024-09-19","tags":["attack.execution","attack.resource-development","attack.t1587"],"technique_ids":["T1587"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Unlikely"],"references":["https://github.com/Gui774ume/ebpfkit","https://github.com/pathtofile/bad-bpf","https://github.com/carlospolop/PEASS-ng","https://github.com/t3l3machus/hoaxshell","https://github.com/t3l3machus/Villain","https://github.com/HavocFramework/Havoc","https://github.com/1N3/Sn1per","https://github.com/Ne0nd0g/merlin","https://github.com/Pennyw0rth/NetExec/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml","source_sha256":"a2feefb4d5c0e858f3dc1f45ec35f873463c364d98846728a15592ad75128301","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux HackTool Execution\nid: a015e032-146d-4717-8944-7a1884122111\nstatus: test\ndescription: Detects known hacktool execution based on image name.\nreferences:\n    - https://github.com/Gui774ume/ebpfkit\n    - https://github.com/pathtofile/bad-bpf\n    - https://github.com/carlospolop/PEASS-ng\n    - https://github.com/t3l3machus/hoaxshell\n    - https://github.com/t3l3machus/Villain\n    - https://github.com/HavocFramework/Havoc\n    - https://github.com/1N3/Sn1per\n    - https://github.com/Ne0nd0g/merlin\n    - https://github.com/Pennyw0rth/NetExec/\nauthor: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])\ndate: 2023-01-03\nmodified: 2024-09-19\ntags:\n    - attack.execution\n    - attack.resource-development\n    - attack.t1587\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_c2_frameworks:\n        Image|endswith:\n            - '/crackmapexec'\n            - '/havoc'\n            - '/merlin-agent'\n            - '/merlinServer-Linux-x64'\n            - '/msfconsole'\n            - '/msfvenom'\n            - '/ps-empire server'\n            - '/ps-empire'\n            - '/sliver-client'\n            - '/sliver-server'\n            - '/Villain.py'\n    selection_c2_framework_cobaltstrike:\n        Image|contains:\n            - '/cobaltstrike'\n            - '/teamserver'\n    selection_scanners:\n        Image|endswith:\n            - '/autorecon'\n            - '/httpx'\n            - '/legion'\n            - '/naabu'\n            - '/netdiscover'\n            - '/nuclei'\n            - '/recon-ng'\n    selection_scanners_sniper:\n        Image|contains: '/sniper'\n    selection_web_enum:\n        Image|endswith:\n            - '/dirb'\n            - '/dirbuster'\n            - '/eyewitness'\n            - '/feroxbuster'\n            - '/ffuf'\n            - '/gobuster'\n            - '/wfuzz'\n            - '/whatweb'\n    selection_web_vuln:\n        Image|endswith:\n            - '/joomscan'\n            - '/nikto'\n            - '/wpscan'\n    selection_exploit_tools:\n        Image|endswith:\n            - '/aircrack-ng'\n            - '/bloodhound-python'\n            - '/bpfdos'\n            - '/ebpfki'\n            - '/evil-winrm'\n            - '/hashcat'\n            - '/hoaxshell.py'\n            - '/hydra'\n            - '/john'\n            - '/ncrack'\n            # default binary: https://github.com/Pennyw0rth/NetExec/releases/download/v1.0.0/nxc-ubuntu-latest\n            - '/nxc-ubuntu-latest'\n            - '/pidhide'\n            - '/pspy32'\n            - '/pspy32s'\n            - '/pspy64'\n            - '/pspy64s'\n            - '/setoolkit'\n            - '/sqlmap'\n            - '/writeblocker'\n    selection_linpeas:\n        # covers: all linux versions listed here: https://github.com/carlospolop/PEASS-ng/releases\n        Image|contains: '/linpeas'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","page":"techniques/enterprise/T1587/"}],"data_path":"data/detection-rules/a015e032-146d-4717-8944-7a1884122111.json","kind":"sigma"}