Package manager spawning a shell or interpreter on Linux

1title: Package manager spawning a shell or interpreter on Linux2id: ed52b230-1c45-48ad-a289-dc616f4eb2523status: experimental4description: |5  Matches AN0698's Linux leg: a pip, npm, poetry or gem install spawning a6  shell or interpreter, the step MITRE describes as an install-time or7  startup-linked payload running. The prior selector matched ParentImage8  directly against '/pip', '/npm', '/gem' and similar — but none of those9  tools are their own process image on Linux. pip/pip3 and poetry are Python10  console-script entry points whose file opens with a shebang line, npm/npx11  are JS files shebanged '#!/usr/bin/env node', and gem is a Ruby script12  shebanged to ruby: the kernel loads the interpreter named on the shebang13  line as the process's actual image, so ParentImage is always python3 (or14  python), node, or ruby — never the tool name itself, regardless of how15  well the parent link is resolved. This rule instead matches the interpreter16  as ParentImage together with the package-manager entry point appearing in17  ParentCommandLine, the shape a shebang re-exec actually produces, e.g.18  `/usr/bin/python3 /usr/bin/pip3 install <pkg>` or19  `node /usr/lib/node_modules/npm/bin/npm-cli.js install <pkg>`. conda is20  dropped from this selector entirely: most installs wire `conda` as a bash21  *function* sourced into the shell's rc file rather than a standalone22  binary, so a child it "spawns" shows ParentImage=bash with nothing in23  ParentCommandLine reliably distinguishing a conda install from any other24  shell activity — catching that form needs a shell-history or25  session-scoped correlation this rule does not attempt, and is out of26  scope here rather than silently assumed to be covered.2728  PREREQUISITE — raw auditd is not enough. A SYSCALL execve record carries29  the process's own `exe=`, a numeric `ppid`, and its own argv, but no parent30  executable path or parent command line at all, so both ParentImage and31  ParentCommandLine are unpopulated and this rule returns zero rows unless32  the process_creation pipeline is fed by something that resolves and joins33  the parent record for you: Auditbeat's `process.parent.executable`34  enrichment plus a ppid-to-execve join for the parent's own argv,35  sysmon-for-linux (whose EventID 1 emits both ParentImage and36  ParentCommandLine directly), or an EDR normalisation layer doing the same37  work. On unenriched auditd, zero rows here means blind, not quiet. AN0698's38  other leg — new script files under ~/.local or ~/.cache within 5 minutes of39  install — is a correlation across a separate auditd PATH record with no40  filename field offered here, so only the process-spawn leg is written; the41  Windows leg (AN0699) is the same parent/child shape already published as42  T1195.001 and is not repeated. A postinstall hook that writes its payload43  and defers execution to cron, a systemd unit or a detached shell breaks the44  parent-child pair and is invisible here even with the enrichment in place.45  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0252, not hand-written and not tested by its author. Any lab result is on this rule's own page.46references:47  - https://attack.mitre.org/techniques/T1204/00548  - https://attack.mitre.org/detectionstrategies/DET025249author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)50date: 2026-08-1651tags:52  - attack.execution53  - attack.t1204.00554logsource:55  category: process_creation56  product: linux57detection:58  selection_manager_pip:59    ParentImage|endswith:60      - '/python3'61      - '/python'62    ParentCommandLine|contains:63      - 'pip'64      - 'poetry'65  selection_manager_npm:66    ParentImage|endswith: '/node'67    ParentCommandLine|contains:68      - 'npm'69      - 'npx'70  selection_manager_gem:71    ParentImage|endswith: '/ruby'72    ParentCommandLine|contains: 'gem'73  selection_payload:74    Image|endswith:75      - '/sh'76      - '/bash'77      - '/dash'78      - '/python3'79      - '/python'80      - '/node'81      - '/curl'82      - '/wget'83      - '/perl'84  condition: (selection_manager_pip or selection_manager_npm or selection_manager_gem) and selection_payload85falsepositives:86  - "Native-extension builds. Python wheels needing a source build and npm packages using node-gyp legitimately spawn sh, python3, bash, curl or wget during an ordinary pip or npm install — the curl/wget calls fetch vendored source tarballs or build dependencies — on a developer or CI host this is the loudest source and needs a toolchain allowlist to separate from a malicious postinstall hook."87  - "PEP 517/518 build-backend invocation. pip and poetry resolving a package's build system spawn a python or python3 subprocess for every source distribution installed, which is standard behaviour and will match selection_manager_pip and selection_payload together on every such install."88  - "gem installing a native extension, which runs extconf.rb through a spawned sh or make step during ordinary Ruby gem installation."89level: low