Suspicious Linux Commands for Privilege Escalation or Persistence

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•34

Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.