{"id":"e4ffe466-6ff8-48d4-94bd-e32d1a6061e2","title":"Nohup Execution","description":"Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-06","modified":"","tags":["attack.execution","attack.t1059.004"],"technique_ids":["T1059.004"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Administrators or installed processes that leverage nohup"],"references":["https://gtfobins.github.io/gtfobins/nohup/","https://en.wikipedia.org/wiki/Nohup","https://www.computerhope.com/unix/unohup.htm"],"source_path":"rules/linux/process_creation/proc_creation_lnx_nohup.yml","source_sha256":"f08acf3990807f669a89cce6992c5d05845fa2e47e5556465846412ca3eaea2c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_nohup.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Nohup Execution\nid: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2\nstatus: test\ndescription: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments\nreferences:\n    - https://gtfobins.github.io/gtfobins/nohup/\n    - https://en.wikipedia.org/wiki/Nohup\n    - https://www.computerhope.com/unix/unohup.htm\nauthor: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'\ndate: 2022-06-06\ntags:\n    - attack.execution\n    - attack.t1059.004\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/nohup'\n    condition: selection\nfalsepositives:\n    - Administrators or installed processes that leverage nohup\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/e4ffe466-6ff8-48d4-94bd-e32d1a6061e2.json","kind":"sigma"}