Unix shell spawned by a network-facing service daemon

1title: Unix shell spawned by a network-facing service daemon2id: e9e26c24-621b-4c22-a0ad-d61d65ca18203status: experimental4description: |5  A Unix shell running is unremarkable on any Linux host, so the parent is the6  entire detection: this rule matches sh, bash, dash, zsh, ksh, ash or busybox7  whose parent is a web, database or file-sharing daemon that has no business8  execing a shell. That is MITRE's ParentProcess knob from AN1081 ("Shell9  invoked by unexpected parents (e.g., curl, mail, apache2)"), populated here10  with a daemon list authored for this rule rather than taken from MITRE.11  php-fpm and uwsgi are matched with contains rather than endswith on purpose,12  because the shipped binaries are version-suffixed (php-fpm8.2,13  uwsgi_python311) and an endswith on the bare name never fires. sshd, cron14  and login are deliberately absent — a shell under those is the system15  working normally. Known gap: a service hosted inside an interpreter is not16  selectable by name here, because the exec is the runtime's — a Tomcat, Jetty17  or Spring Boot app appears as java and a Gunicorn worker as python3, so an18  RCE in one of those produces a shell whose ParentImage is the runtime. The19  osquery socket_events and syslog auth.log legs of AN1081 are not authored:20  the shell-to-network-discovery chain and the remote-session attribution both21  need a join across sources within a time window, which lib/sigma has no22  construct for, and AN1082's macOS leg is macos/unifiedlog with no field23  schema anywhere in the brief. The rule is written in the Sigma linux24  process_creation vocabulary (Image, ParentImage); a raw auditd SYSCALL feed25  carries the same facts as exe= and ppid and needs a field mapping first, and26  auditd records no execve at all until an explicit execve audit rule is27  loaded.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0384, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T1059/00431  - https://attack.mitre.org/detectionstrategies/DET038432author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1734tags:35  - attack.execution36  - attack.t1059.00437logsource:38  category: process_creation39  product: linux40detection:41  selection_shell:42    Image|endswith:43      - '/sh'44      - '/bash'45      - '/dash'46      - '/zsh'47      - '/ksh'48      - '/ash'49      - '/busybox'50  selection_parent_daemon:51    ParentImage|endswith:52      - '/httpd'53      - '/apache2'54      - '/nginx'55      - '/lighttpd'56      - '/mysqld'57      - '/mariadbd'58      - '/postgres'59      - '/redis-server'60      - '/memcached'61      - '/vsftpd'62      - '/proftpd'63      - '/smbd'64  selection_parent_versioned:65    ParentImage|contains:66      - '/php-fpm'67      - '/uwsgi'68  condition: selection_shell and (selection_parent_daemon or selection_parent_versioned)69falsepositives:70  - "Web applications that shell out by design from PHP — WordPress, Nextcloud and Magento cron runners, ImageMagick and ffmpeg thumbnail helpers, and backup plugins that call sh -c mysqldump, all reached through exec() or shell_exec() under php-fpm. On a CMS or shared-hosting box this is the highest-volume match by a wide margin and fires on the application's own schedule rather than on human activity."71  - "PostgreSQL archive_command and restore_command, which the archiver process runs through /bin/sh once per WAL segment, so a busy database emits a steady stream of postgres-parented shells that no operator ever sees."72  - "Apache mod_cgi and suexec serving shell CGI scripts, where a .sh or .cgi file with a #!/bin/sh shebang makes httpd or apache2 the parent of /bin/sh every time the page is requested."73  - "Samba print and VFS commands and vsftpd upload hooks, which are configured as shell command strings and are therefore executed as a child shell of smbd or vsftpd on every matching client operation."74level: medium