Rule Info
Name
Shell Invocation via Env Command - Linux
Author
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Description
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Date
2024-09-02 00:00:00
Modified
None
Id
bed978f8-7f3a-432b-82c5-9286a9b3031a
Tags
attack.execution attack.t1059 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR