linux:sysmon 1
Process creation
- Log source
- Sysmon for Linux
- Host type
- Linux
- Tier, host type
- Minimum
- Techniques
- 6
- Rules depending on it
- Splunk 105, Sigma 145
Why this tier
CISA/ASD
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Minimum | CISA/ASD |
| Linux web server, internet-facing | Minimum | CISA/ASD |
Techniques it helps detect
Rules that depend on it
Splunk 105
- Curl Execution with Percent Encoded URL
- File Download or Read to Pipe Execution
- Inline PHP Code Execution
- Java Writing JSP File
- Linux APT Privilege Escalation
- Linux AWK Privilege Escalation
- Linux Add User Account
- Linux Apparmor Bypass Via Aaexec
- Linux At Application Execution
- Linux Binary Executed from Shared Memory Directory
- Linux Busybox Privilege Escalation
- Linux Change File Owner To Root
- Linux Clipboard Data Copy
- Linux Common Process For Elevation Control
- Linux Composer Privilege Escalation
- Linux Cpulimit Privilege Escalation
- Linux Crontab Enumeration
- Linux Csvtool Privilege Escalation
- Linux Curl Upload File
- Linux DD File Overwrite
- Linux Data Destruction Command
- Linux Decode Base64 to Shell
- Linux Deleting Critical Directory Using RM Command
- Linux Disable Services
- Linux Doas Tool Execution
- Linux Docker Root Directory Mount
- Linux Docker Shell Execution
- Linux Edit Cron Table Parameter
- Linux Emacs Privilege Escalation
- Linux Find Privilege Escalation
- Linux GDB Privilege Escalation
- Linux GNU Awk Privilege Escalation
- Linux Gdrive Binary Activity
- Linux Gem Privilege Escalation
- Linux Ghostscript Exploitation
- Linux Hardware Addition SwapOff
- Linux Impair Defenses Process Kill
- Linux Indicator Removal Clear Cache
- Linux Indicator Removal Service File Deletion
- Linux Ingress Tool Transfer Hunting
- Linux Ingress Tool Transfer with Curl
- Linux Insert Kernel Module Using Insmod Utility
- Linux Install Kernel Module Using Modprobe Utility
- Linux Iptables Firewall Modification
- Linux Kernel Module Enumeration
- Linux Kworker Process In Writable Process Path
- Linux Make Privilege Escalation
- Linux MySQL Privilege Escalation
- Linux NOPASSWD Entry In Sudoers File
- Linux Ngrok Reverse Proxy Usage
- Linux Node Privilege Escalation
- Linux Obfuscated Files or Information Base64 Decode
- Linux Octave Privilege Escalation
- Linux OpenVPN Privilege Escalation
- Linux PHP Privilege Escalation
- Linux Possible Access Or Modification Of sshd Config File
- Linux Possible Access To Credential Files
- Linux Possible Access To Sudoers File
- Linux Possible Append Command To At Allow Config File
- Linux Possible Append Command To Profile Config File
- Linux Possible Append Cronjob Entry on Existing Cronjob File
- Linux Possible Bootloader Modification
- Linux Possible Cronjob Modification With Editor
- Linux Possible GSM Privilege Escalation
- Linux Possible Nimbuspwn Privilege Escalation
- Linux Preload Hijack Library Calls
- Linux Proxy Socks Curl
- Linux Puppet Privilege Escalation
- Linux RPM Privilege Escalation
- Linux Root Execution of id
- Linux Ruby Privilege Escalation
- Linux SSH Authorized Keys Modification
- Linux SSH Remote Services Script Execute
- Linux Service Restarted
- Linux Service Started Or Enabled
- Linux Setuid Using Chmod Utility
- Linux Setuid Using Setcap Utility
- Linux Shell History Access Via Command Line Utility
- Linux Shell Pseudo Device Reverse Shell
- Linux Shred Overwrite Command
- Linux Sqlite3 Privilege Escalation
- Linux Stdout Redirection To Dev Null File
- Linux Stop Services
- Linux Sudo OR Su Execution
- Linux Suspicious Child Process of PostgreSQL
- Linux Suspicious Docker Build Command Execution
- Linux Suspicious GCC Invocation Building Init Shared Object
- Linux Suspicious Namespace Creation
- Linux Suspicious Privileged Container Execution
- Linux Suspicious React or Next.js Child Process
- Linux Suspicious Redis Activity
- Linux System Network Discovery
- Linux System Reboot Via System Request Key
- Linux Telnet Authentication Bypass
- Linux Unix Shell Enable All SysRq Functions
- Linux Usermod Root UID Set
- Linux Visudo Utility Execution
- Linux c89 Privilege Escalation
- Linux c99 Privilege Escalation
- Linux pkexec Privilege Escalation
- Socat Network Listener Binding an Executable
- Socat Remote TCP Connection with Local Echo Disabled
- Suspicious Curl Network Connection
- Suspicious Linux Discovery Commands
- Web or Application Server Spawning a Shell
Sigma 145
- Access of Sudoers File Content by Florian Roth (Nextron Systems)
- Apache Spark Shell Command Injection - ProcessCreation by Nasreddine Bencherchali (Nextron Systems)
- Atlassian Confluence CVE-2022-26134 by Nasreddine Bencherchali (Nextron Systems)
- Audit Rules Deleted Via Auditctl by Mohamed LAKRI
- Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator by Gene Kazimiarovich
- Axios NPM Compromise Indicators - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- BPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
- Bash Interactive Shell by @d4ns4n_
- CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) by Andreas Braathen (mnemonic.io)
- Capabilities Discovery - Linux by Nasreddine Bencherchali (Nextron Systems)
- Capsh Shell Invocation - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Chmod Targeting Sensitive Directories by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
- Clipboard Collection with Xclip Tool by Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- Connection Proxy by Ömer Günal
- Container Residence Discovery Via Proc Virtual FS by Seth Hanford
- Copy Passwd Or Shadow From TMP Path by Joseliyo Sanchez, @Joseliyo_Jstnk
- Crontab Enumeration by Joseliyo Sanchez, @Joseliyo_Jstnk
- Curl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
- DD File Overwrite by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- Decode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community
- Disable Or Stop Services by Nasreddine Bencherchali (Nextron Systems)
- Disabling Security Tools by Ömer Günal, Alejandro Ortuno, oscd.community
- Docker Container Discovery Via Dockerenv Listing by Seth Hanford
- Download File To Potentially Suspicious Directory Via Wget by Joseliyo Sanchez, @Joseliyo_Jstnk
- ESXi Account Creation Via ESXCLI by Cedric Maurugeon
- ESXi Admin Permission Assigned To Account Via ESXCLI by Nasreddine Bencherchali (Nextron Systems)
- ESXi Network Configuration Discovery Via ESXCLI by Cedric Maurugeon
- ESXi Storage Information Discovery Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
- ESXi Syslog Configuration Change Via ESXCLI by Cedric Maurugeon
- ESXi System Information Discovery Via ESXCLI by Cedric Maurugeon
- ESXi VM Kill Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
- ESXi VM List Discovery Via ESXCLI by Cedric Maurugeon
- ESXi VSAN Information Discovery Via ESXCLI by Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
- Enable BPF Kprobes Tracing by Nasreddine Bencherchali (Nextron Systems)
- Execution Of Script Located In Potentially Suspicious Directory by Joseliyo Sanchez, @Joseliyo_Jstnk
- File Deletion by Ömer Günal, oscd.community
- File and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
- Flush Iptables Ufw Chain by Joseliyo Sanchez, @Joseliyo_Jstnk
- Group Has Been Deleted Via Groupdel by Tuan Le (NCSGroup)
- History File Deletion by Florian Roth (Nextron Systems)
- Inline Python Execution - Spawn Shell Via OS System Library by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Install Root Certificate by Ömer Günal, oscd.community
- Interactive Bash Suspicious Children by Florian Roth (Nextron Systems)
- Kaspersky Endpoint Security Stopped Via CommandLine - Linux by Milad Cheraghi
- Linux Base64 Encoded Pipe to Shell by pH-T (Nextron Systems)
- Linux Base64 Encoded Shebang In CLI by Nasreddine Bencherchali (Nextron Systems)
- Linux Crypto Mining Indicators by Florian Roth (Nextron Systems)
- Linux Doas Tool Execution by Sittikorn S, Teoderick Contreras
- Linux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
- Linux Logs Clearing Attempts by Ömer Günal, oscd.community
- Linux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
- Linux Package Uninstall by Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
- Linux Recon Indicators by Florian Roth (Nextron Systems)
- Linux Remote System Discovery by Alejandro Ortuno, oscd.community
- Linux Setgid Capability Set on a Binary via Setcap Utility by Luc Génaux
- Linux Setuid Capability Set on a Binary via Setcap Utility by Luc Génaux
- Linux Shell Pipe to Shell by Florian Roth (Nextron Systems)
- Linux Sudo Chroot Execution by Swachchhanda Shrawn Poudel (Nextron Systems)
- Linux Suspicious Child Process from Node.js - React2Shell by Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
- Linux Webshell Indicators by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- LiteLLM / TeamPCP Supply Chain Attack Indicators by Swachchhanda Shrawan Poudel (Nextron Systems)
- Local Groups Discovery - Linux by Ömer Günal, Alejandro Ortuno, oscd.community
- Local System Accounts Discovery - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
- Mask System Power Settings Via Systemctl by Milad Cheraghi, Nasreddine Bencherchali
- Mount Execution With Hidepid Parameter by Joseliyo Sanchez, @Joseliyo_Jstnk
- Named Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)
- Nohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
- OMIGOD SCX RunAsProvider ExecuteScript by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- OMIGOD SCX RunAsProvider ExecuteShellCommand by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- OS Architecture Discovery Via Grep by Joseliyo Sanchez, @Joseliyo_Jstnk
- PUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Pnscan Binary Data Transmission Activity by David Burkett (@signalblur)
- Potential Container Discovery Via Inodes Listing by Seth Hanford
- Potential Discovery Activity Using Find - Linux by Nasreddine Bencherchali (Nextron Systems)
- Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process by Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke
- Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 by Milad Cheraghi
- Potential GobRAT File Discovery Via Grep by Joseliyo Sanchez, @Joseliyo_Jstnk
- Potential Linux Amazon SSM Agent Hijacking by Muhammad Faisal
- Potential Linux Process Code Injection Via DD Utility by Joseph Kamau
- Potential Netcat Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
- Potential PHP Reverse Shell by @d4ns4n_
- Potential Perl Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
- Potential Ruby Reverse Shell by @d4ns4n_
- Potential Suspicious Change To Sensitive/Critical Files by @d4ns4n_ (Wuerth-Phoenix)
- Potential Xterm Reverse Shell by @d4ns4n_
- Potentially Suspicious Execution From Tmp Folder by Joseliyo Sanchez, @Joseliyo_Jstnk
- Potentially Suspicious Named Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)
- Print History File Contents by Florian Roth (Nextron Systems)
- Process Discovery by Ömer Günal, oscd.community, CheraaghiMilad
- Process Execution From Shared Memory Directory by Stan Beukers
- Python One-Liners with Base64 Decoding - Linux by Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
- Python Reverse Shell Execution Via PTY And Socket Modules by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
- Python Spawning Pretty TTY Via PTY Module by Nextron Systems
- Python WebServer Execution - Linux by Mohamed LAKRI
- Remote Access Tool - Team Viewer Session Started On Linux Host by Josh Nickels, Qi Nan
- Remove Immutable File Attribute by Nasreddine Bencherchali (Nextron Systems)
- Remove Scheduled Cron Task/Job by Nasreddine Bencherchali (Nextron Systems)
- Scheduled Cron Task/Job - Linux by Alejandro Ortuno, oscd.community
- Scheduled Task/Job At by Ömer Günal, oscd.community
- Script Interpreter Spawning Credential Scanner - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Security Software Discovery - Linux by Daniil Yugoslavskiy, oscd.community
- Setuid and Setgid by Ömer Günal
- Shai-Hulud 2.0 Malicious NPM Package Installation - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Shai-Hulud Malicious Bun Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Shai-Hulud Malware Indicators - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Shai-Hulud NPM Package Malicious Exfiltration via Curl by Swachchhanda Shrawan Poudel (Nextron Systems)
- Shell Execution GCC - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Execution Of Process Located In Tmp Directory by Joseliyo Sanchez, @Joseliyo_Jstnk
- Shell Execution via Find - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Execution via Flock - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Execution via Git - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Execution via Nice - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Execution via Rsync - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
- Shell Invocation Via Ssh - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Invocation via Apt - Linux by Nasreddine Bencherchali (Nextron Systems)
- Shell Invocation via Env Command - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Shell Spawned by Celery Worker Process by Jennifer Batina
- Sudo Privilege Escalation CVE-2019-14287 by Florian Roth (Nextron Systems)
- Suspicious Child Process of SAP NetWeaver - Linux by Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Curl Change User Agents - Linux by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Curl File Upload - Linux by Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
- Suspicious Download and Execute Pattern via Curl/Wget by Aayush Gupta
- Suspicious Git Clone - Linux by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Invocation of Shell via AWK - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
- Suspicious Invocation of Shell via Rsync by Florian Roth
- Suspicious Java Children Processes by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Nohup Execution by Joseliyo Sanchez, @Joseliyo_Jstnk
- Suspicious Package Installed - Linux by Nasreddine Bencherchali (Nextron Systems)
- Syslog Clearing or Removal Via System Utilities by Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- System Information Discovery by Ömer Günal, oscd.community
- System Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community
- System Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
- TanStack Supply-Chain Attack Execution Indicators - Linux by Leonardo Gasparini
- Terminate Linux Process Via Kill by Tuan Le (NCSGroup)
- Touch Suspicious Service File by Joseliyo Sanchez, @Joseliyo_Jstnk
- Triple Cross eBPF Rootkit Execve Hijack by Nasreddine Bencherchali (Nextron Systems)
- Triple Cross eBPF Rootkit Install Commands by Nasreddine Bencherchali (Nextron Systems)
- UFW Disable Attempt by Joseliyo Sanchez, @Joseliyo_Jstnk
- UNC4841 - Download Compressed Files From Temp.sh Using Wget by Nasreddine Bencherchali (Nextron Systems)
- UNC4841 - Download Tar File From Untrusted Direct IP Via Wget by Nasreddine Bencherchali (Nextron Systems)
- UNC4841 - Potential SEASPY Execution by Nasreddine Bencherchali (Nextron Systems)
- UNC4841 - SSL Certificate Exfiltration Via Openssl by Nasreddine Bencherchali (Nextron Systems)
- User Added To Root/Sudoers Group Using Usermod by TuanLe (GTSC)
- User Has Been Deleted Via Userdel by Tuan Le (NCSGroup)
- Vim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| ASD ACSC / CISA et al.: Process creation and command-line auditingBest Practices for Event Logging and Threat Detection (Aug 2024) | Names this event | our analysis |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | ProcessRollup2 | Full | as EXECVE |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | SyntheticProcessRollup2 | Full | as EXECVE |
| Microsoft Defender for Endpoint device tables | DeviceProcessEvents | Full | as EXECVE |
| Elastic Defend endpoint events | process | Full | Elastic Defend for Linux process dataset |