Linux browser process spawning a shell or script interpreter

Siemphony@siemphonylowT1566.002unverified

Matches the execution leg of AN0299 on Linux — a shell or scripting interpreter spawned directly by a browser process, the step MITRE describes as "shell or interpreter launched from browser process" after a spearphishing link is followed. This is deliberately not the Windows shape: T1204.001 already owns the DNS-resolution leg of the equivalent Windows analytic (browser resolving a high-risk TLD) and T1567.001 already owns DNS lookups to code-repository domains, and the Windows process_creation leg — a browser or document app spawning a LOLBIN child — is already published at the parent technique T1204 with the same process lists this rule would otherwise repeat. auditd's process_creation carries the real executable in `exe=`, so a Firefox or Chromium binary as ParentImage is a reliable anchor; MITRE's MonitoredBrowsers knob is used verbatim for the parent list, and the child list is authored here from common Linux shells and script interpreters a downloaded payload would invoke. PhishingIndicators (obfuscated/homograph URL regex) has no field to test against in a process-creation event and is not attempted. Requires an auditd rule arming the execve syscall, which is not present on a default install of any mainstream distribution. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0107, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "/firefox" or InitiatingProcessFolderPath endswith "/firefox-bin" or InitiatingProcessFolderPath endswith "/chrome" or InitiatingProcessFolderPath endswith "/google-chrome" or InitiatingProcessFolderPath endswith "/chromium" or InitiatingProcessFolderPath endswith "/chromium-browser") and (FolderPath endswith "/bash" or FolderPath endswith "/sh" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/python3" or FolderPath endswith "/python" or FolderPath endswith "/perl"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*/firefox" OR ParentImage="*/firefox-bin" OR ParentImage="*/chrome" OR ParentImage="*/google-chrome" OR ParentImage="*/chromium" OR ParentImage="*/chromium-browser") AND (Image="*/bash" OR Image="*/sh" OR Image="*/dash" OR Image="*/zsh" OR Image="*/python3" OR Image="*/python" OR Image="*/perl"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*/firefox" OR TO_LOWER(process.parent.executable) LIKE "*/firefox-bin" OR TO_LOWER(process.parent.executable) LIKE "*/chrome" OR TO_LOWER(process.parent.executable) LIKE "*/google-chrome" OR TO_LOWER(process.parent.executable) LIKE "*/chromium" OR TO_LOWER(process.parent.executable) LIKE "*/chromium-browser") AND (TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/dash" OR TO_LOWER(process.executable) LIKE "*/zsh" OR TO_LOWER(process.executable) LIKE "*/python3" OR TO_LOWER(process.executable) LIKE "*/python" OR TO_LOWER(process.executable) LIKE "*/perl"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(/firefox$|/firefox-bin$|/chrome$|/google-chrome$|/chromium$|/chromium-browser$)</field>    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/dash$|/zsh$|/python3$|/python$|/perl$)</field>    <description>Linux browser process spawning a shell or script interpreter</description>    <mitre>      <id>T1566.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: fcc6ac09-df27-4d2f-8d4d-fecaa55764e2

ATT&CKT1566.002

T1566.002Spearphishing Link

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

AN0299 describes a three-stage chain on Linux: email with a suspicious URL → user click recorded in mail/web proxy logs → shell or interpreter launched from the browser process. This rule covers only that last stage — a single auditd process_creation event where a browser spawns a shell or script interpreter. The email-arrival and click-logging legs are out of scope; the rule's own description notes the DNS-resolution leg is already owned by T1204.001 and T1567.001, and the Windows LOLBIN-spawn shape by parent technique T1204, so this rule deliberately doesn't repeat them. A hit here means a browser process spawned a shell — it says nothing about whether an email or a click preceded it.

02 · Telemetry you need

category: process_creation, product: linux, sourced from auditd. This requires an explicit auditd rule arming the execve syscall — absent on a default install of any mainstream distribution, so silence here usually means "not audited," not "clean." All four backends (Sentinel, Splunk, Elastic, Wazuh) render this rule without refusal or warning; the field mapping is uncontested across platforms.

03 · How the logic works

Two endswith selections, ANDed. selection_browser_parent matches ParentImage against six binary paths: /firefox, /firefox-bin, /chrome, /google-chrome, /chromium, /chromium-browser. MITRE's MonitoredBrowsers knob (AN0299) only names three illustrative examples — firefox, chrome, chromium — in the brief; the other three (firefox-bin, google-chrome, chromium-browser) are binary-name variants the rule author added. The rule's own description calls this list "verbatim," which overstates MITRE's contribution — half the entries are authored, not sourced. selection_ interpreter_child matches Image against seven shell/interpreter suffixes (bash, sh, dash, zsh, python3, python, perl), authored entirely by the rule writer — there's no corresponding MITRE knob for this list. PhishingIndicators (MITRE's obfuscated/homograph-URL regex knob) isn't used at all: a process-creation event carries no URL field to test it against.

04 · Common false positives

The central problem, per review: the top false positive shares the exact same mechanism as the true positive. xdg-open, invoked through /bin/sh, fires on essentially every external link, mailto: link, and downloaded-file open action a Linux desktop browser handles — which is structurally identical to "shell launched from browser process," AN0299's entire execution-leg definition. Without the mail/proxy correlation legs this rule doesn't implement, the selector can't tell a phishing payload from a user opening a PDF. A second listed false positive — crash-reporter/update-helper shell scripts — is weakly grounded: Firefox's crash reporter is a compiled binary, not a script, and Chrome on Linux typically updates via the system package manager, not a self-spawned shell child. Native-messaging host wrappers (password managers, ad blockers) are a better-grounded noise source.

05 · Detection maturity

tier_1: .** Machine-derived from a MITRE scaffold, reviewed statically, never run against auditd logs. The false-positive analysis above comes from reasoning about the mechanism, not from observed hit volume — that remains unknown until this runs read-only against real desktop or server traffic.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Require the child process's CommandLine to reference a Downloads/tmp path
Treat this rule as one correlation input for AN0299, not a standalone
A static ELF payload, or any interpreter not in the list (node, ruby, a
Browser-automation tooling (Selenium's geckodriver, Puppeteer/headless-
Given how loud the top false positive is, level: low is arguably still

Declared by the author

xdg-open and its downstream MIME handlers, which browsers on Linux invoke through /bin/sh on essentially every external link, mailto: link and downloaded-file open action — this is not specific to a malicious click and is the single largest source of matches on a desktop system.
Browser-extension native messaging hosts (password managers, ad blockers, enterprise policy agents) that communicate with the browser through a small wrapper script exec'd from the browser process, a normal part of how the native messaging protocol works rather than anything the user clicked.
The browser's own crash reporter and update helper, which are frequently thin shell scripts spawned directly by the running browser binary during a crash or a background update check.
Desktop-environment file-type dispatch invoked from the browser's download bar ("Open Containing Folder", "Open With") that hands off to a shell before launching the target application, independent of whether the downloaded file came from a phishing link.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1566.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/fcc6ac09-df27-4d2f-8d4d-fecaa55764e2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Linux browser process spawning a shell or script interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it