GNU split invoked with a command-executing --filter argument

1title: GNU split invoked with a command-executing --filter argument2id: 6797ea87-b3da-480c-abd6-a79760eb9d003status: experimental4description: |5  Matches execution of the coreutils split binary with a --filter argument,6  the mechanism MITRE's own technique text and its GTFO split citation name as7  the parent-level example of proxying a command through a trusted binary —8  split hands each output chunk to the filter program on stdin, so any command9  named there runs as its child. This is the one piece of AN0227 with a fixed,10  checkable shape; the rest of the analytic ("uncommon sequences or chained11  behaviors") and its AnomalyScore knob describe a statistical baseline no12  Sigma selector expresses. CommandLine here is reconstructed from auditd's13  a0..aN fields, and a --filter value containing a space (a shell redirection14  or pipe, the common benign form) lands in one argument auditd hex-encodes15  whole, so this rule reliably catches only the plain --filter=<binary> form16  GTFOBins itself documents, not a redirected one. It is also the only17  genuinely parent-level slice of the technique: the Windows binaries AN022618  names — rundll32.exe, msiexec.exe and regsvr32.exe — each already have a19  dedicated child sub-technique in the current ATT&CK v19.2 corpus20  (Rundll32 T1218.011, Msiexec T1218.007, Regsvr32 T1218.010, all confirmed21  against attack.mitre.org/techniques/T1218 and against this pipeline's own22  T1218.007/.009/.010/.011 scaffolds) and belong there, not here. That23  crosswalk is not supplied anywhere in this technique's own brief.json —24  it comes from checking the sibling techniques directly, not from anything25  in this scaffold — so treat it as authored, verifiable background rather26  than a MITRE-sourced field. PREREQUISITE — auditd does not record execve by27  default; this rule needs an armed watch rule such as28  `-a always,exit -F arch=b64 -S execve`, the same prerequisite the sibling29  T1071 rule in this corpus states. Without it, zero matches means the30  syscall was never audited, not that no proxying occurred.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0081, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T121834  - https://attack.mitre.org/detectionstrategies/DET008135author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.defense-evasion39  - attack.t121840logsource:41  category: process_creation42  product: linux43detection:44  selection_tool:45    Image|endswith: '/split'46  selection_filter:47    CommandLine|contains:48      - '--filter='49      - '--filter '50  condition: selection_tool and selection_filter51falsepositives:52  - "A --filter value with no embedded space, for example --filter=/bin/gzip writing to a fixed path — the simple form of a legitimate compress-while-splitting pipeline, indistinguishable on the command line from the GTFOBins shell escape this rule targets."53  - "A log pipeline that decodes auditd's hex-encoded arguments before this rule sees them, which would additionally surface the common --filter='gzip > $FILE.gz' redirection form used by backup and log-rotation scripts."54  - "An administrator manually testing a no-redirection --filter form such as --filter=gzip while reading the coreutils manual, which needs no shell metacharacter and so is not hex-encoded by auditd, unlike the manual's own piped --filter example."55level: low