{"id":"ea3ecad2-db86-4a89-ad0b-132a10d2db55","title":"Interactive Bash Suspicious Children","description":"Detects suspicious interactive bash as a parent to rather uncommon child processes","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-03-14","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1036"],"technique_ids":["T1036","T1059.004"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate software that uses these patterns"],"references":["Internal Research"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml","source_sha256":"f4dbbac43bea29f6a68822eeb7e289c8e2fe22fc831ed6047b69d593f008407e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Interactive Bash Suspicious Children\nid: ea3ecad2-db86-4a89-ad0b-132a10d2db55\nstatus: test\ndescription: Detects suspicious interactive bash as a parent to rather uncommon child processes\nreferences:\n    - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-14\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.004\n    - attack.t1036\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        ParentCommandLine: 'bash -i'\n    anomaly1:\n        CommandLine|contains:\n            - '-c import '\n            - 'base64'\n            - 'pty.spawn'\n    anomaly2:\n        Image|endswith:\n            - 'whoami'\n            - 'iptables'\n            - '/ncat'\n            - '/nc'\n            - '/netcat'\n    condition: selection and 1 of anomaly*\nfalsepositives:\n    - Legitimate software that uses these patterns\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/ea3ecad2-db86-4a89-ad0b-132a10d2db55.json","kind":"sigma"}