Sunturai
Back to results
MediumSplunk security contentBhavin Patel +1

Suspicious Linux Discovery Commands

The following analytic detects the execution of suspicious bash commands commonly used in scripts like AutoSUID, LinEnum, and LinPeas for system discovery on a Linux host. It leverages Endpoint Detection and Response…

Description

The following analytic detects the execution of suspicious bash commands commonly used in scripts like AutoSUID, LinEnum, and LinPeas for system discovery on a Linux host. It leverages Endpoint Detection and Response (EDR) data, specifically looking for a high number of distinct commands executed within a short time frame. This activity is significant as it often precedes privilege escalation or other malicious actions. If confirmed malicious, an attacker could gain detailed system information, identify vulnerabilities, and potentially escalate privileges, posing a severe threat to the environment.

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSNetwork Devices

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_for_linux_eventid_1

Known benign triggers

  • Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice