GNU split invoked with a command-executing --filter argument

Siemphony@siemphonylowT1218unverified

Matches execution of the coreutils split binary with a --filter argument, the mechanism MITRE's own technique text and its GTFO split citation name as the parent-level example of proxying a command through a trusted binary — split hands each output chunk to the filter program on stdin, so any command named there runs as its child. This is the one piece of AN0227 with a fixed, checkable shape; the rest of the analytic ("uncommon sequences or chained behaviors") and its AnomalyScore knob describe a statistical baseline no Sigma selector expresses. CommandLine here is reconstructed from auditd's a0..aN fields, and a --filter value containing a space (a shell redirection or pipe, the common benign form) lands in one argument auditd hex-encodes whole, so this rule reliably catches only the plain --filter=<binary> form GTFOBins itself documents, not a redirected one. It is also the only genuinely parent-level slice of the technique: the Windows binaries AN0226 names — rundll32.exe, msiexec.exe and regsvr32.exe — each already have a dedicated child sub-technique in the current ATT&CK v19.2 corpus (Rundll32 T1218.011, Msiexec T1218.007, Regsvr32 T1218.010, all confirmed against attack.mitre.org/techniques/T1218 and against this pipeline's own T1218.007/.009/.010/.011 scaffolds) and belong there, not here. That crosswalk is not supplied anywhere in this technique's own brief.json — it comes from checking the sibling techniques directly, not from anything in this scaffold — so treat it as authored, verifiable background rather than a MITRE-sourced field. PREREQUISITE — auditd does not record execve by default; this rule needs an armed watch rule such as `-a always,exit -F arch=b64 -S execve`, the same prerequisite the sibling T1071 rule in this corpus states. Without it, zero matches means the syscall was never audited, not that no proxying occurred. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0081, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "/split" and (ProcessCommandLine contains "--filter=" or ProcessCommandLine contains "--filter "))

Splunk · SPL

Run this as a search.

index=* (Image="*/split" AND (CommandLine="*--filter=*" OR CommandLine="*--filter *"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*/split" AND (TO_LOWER(process.command_line) LIKE "*--filter=*" OR TO_LOWER(process.command_line) LIKE "*--filter *"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/split$</field>    <field name="CommandLine" type="pcre2">(?i)(--filter=|--filter )</field>    <description>GNU split invoked with a command-executing --filter argument</description>    <mitre>      <id>T1218</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6797ea87-b3da-480c-abd6-a79760eb9d00

ATT&CKT1218

T1218System Binary Proxy Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxy

01 · What this rule detects

Attacker code executed through a Microsoft-signed utility so that the execution inherits a trusted signature and a familiar image name — rundll32, regsvr32, mshta, cmstp, msiexec, regasm and their relatives. The binary is legitimate and present on every Windows host; the arguments are what belongs to the attacker. This is worth catching because signature checks, allowlists and any rule that filters on 'signed by Microsoft' will pass it.

02 · Telemetry you need

Process creation with the complete, untruncated command line and the parent — Sysmon EventID 1, or Security 4688 with both Audit Process Creation and the command-line inclusion policy enabled; neither is on by default
Sysmon EventID 7 (ImageLoad) Image and ImageLoaded, to see which module a proxy binary actually loaded
Sysmon EventID 3 (NetworkConnect) tied to the same process id — these binaries fetching remote content is the loudest variant
Sysmon EventID 11 (FileCreate) for the scriptlet, DLL or MSI written just before execution
AppLocker or WDAC audit events (Microsoft-Windows-AppLocker EXE/DLL, MSI and Script logs) — present only where a policy is deployed, even in audit mode

03 · How the logic works

The image name alone is not a detection: rundll32 and msiexec run constantly on a healthy host. Every workable rule in this class is an AND between the image and the shape of its argument. The argument is where the signal lives — a URL or UNC path passed to regsvr32 or msiexec, a scriptlet extension, a protocol handler in an mshta argument, an INF file outside the VPN profile directories for cmstp, a DLL path under a user-writable directory, or rundll32 invoked with no arguments at all. Parentage is the second anchor and often the better one: these binaries launched by an Office application, a browser or a script host mean something quite different from the same binary launched by the installer service. Resist writing one rule per binary with a long keyword list — a rule per binary, anchored on that binary's specific abuse shape, stays readable and tunes independently.

04 · Common false positives

Software distribution running installers — SCCM, Intune and their msiexec invocations, including repair and reinstall
Printer, display and device drivers, which use rundll32 with printui.dll and similar entry points routinely
Control Panel applets and legacy shell handlers invoked through rundll32 by Explorer
Line-of-business applications still shipping HTA front ends, and vendor setup wrappers that call regsvr32 during registration
Genuine VPN client provisioning through cmstp, and .NET installers calling InstallUtil or RegAsm during deployment

05 · Detection maturity

Tier 1 — starting point: Matches known abuse strings in the command line of a handful of these binaries.
Tier 2 — tuned: Pairs each binary with its specific abuse shape and the parent process, excluding software distribution by signed path.
Tier 3 — correlated: Adds the loaded module, the file written immediately before, and whether that module has been seen anywhere else in the fleet.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline the module and entry-point pairs your fleet actually uses for rundll32; the recurring ones are a short list and the outliers are the point of the rule
Alert first on the network-facing arguments — a remote path in the command line is the highest-payoff single condition in this category
Exclude on parent process and account together rather than on the argument, because the argument is the attacker's half
Match the argument case-insensitively and allow for quoting and extra whitespace; these command lines are assembled by hand
Where the telemetry has it, prefer the loaded-module event over the command line for rundll32 — it records what was really loaded rather than what was asked for

Declared by the author

A --filter value with no embedded space, for example --filter=/bin/gzip writing to a fixed path — the simple form of a legitimate compress-while-splitting pipeline, indistinguishable on the command line from the GTFOBins shell escape this rule targets.
A log pipeline that decodes auditd's hex-encoded arguments before this rule sees them, which would additionally surface the common --filter='gzip > $FILE.gz' redirection form used by backup and log-rotation scripts.
An administrator manually testing a no-redirection --filter form such as --filter=gzip while reading the coreutils manual, which needs no shell metacharacter and so is not hex-encoded by auditd, unlike the manual's own piped --filter example.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218, evaluated against their process_creation events.

Share this rule

/u/siemphony/6797ea87-b3da-480c-abd6-a79760eb9d00

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

GNU split invoked with a command-executing --filter argument

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it