Detectionhightest

Suspicious Nohup Execution

Detects execution of binaries located in potentially suspicious locations via "nohup"

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Joseliyo SanchezCreated Fri Jun 02457df417-8b9d-4912-85f3-9dbda39c3645linux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/nohup'
        CommandLine|contains: '/tmp/'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Related Rules

DerivedDetectionmedium

Nohup Execution

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

457df417-8b9d-4912-85f3-9dbda39c3645

Status

test

Level

high

Type

Detection

Created

Fri Jun 02

Author

Joseliyo Sanchez

Path

rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml

Raw Tags

attack.execution

View on GitHub