Detectionhightest

JexBoss Command Sequence

Detects suspicious command sequence that JexBoss

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Thu Aug 24Updated Sat Nov 228ec2c8b4-557a-4121-b87c-5dfb3a602faelinux

Log Source

Linux

ProductLinux← raw: linux

Detection Logic

detection:
    keywords:
        '|all':
            - 'bash -c /bin/bash'
            - '&/dev/tcp/'
    condition: keywords

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

8ec2c8b4-557a-4121-b87c-5dfb3a602fae

Status

test

Level

high

Type

Detection

Created

Thu Aug 24

Modified

Sat Nov 22

Author

Path

rules/linux/builtin/lnx_susp_jexboss.yml

Raw Tags

attack.executionattack.t1059.004