title: Interactive Bash Suspicious Children
id: ea3ecad2-db86-4a89-ad0b-132a10d2db55
status: experimental
description: Detects suspicious interactive bash as a parent to rather uncommon child processes
references:
   - Internal Research
date: 2022/03/14
author: Florian Roth
logsource:
   product: linux
   category: process_creation
detection:
   selection:
      ParentCommandLine: 'bash -i'
   anomaly1:
      CommandLine|contains:
        - '-c import '
        - 'base64'
        - 'pty.spawn'
   anomaly2:
      Image|endswith: 
         - 'whoami'
         - 'iptables'
         - '/ncat'
         - '/nc'
         - '/netcat'
   condition: selection and 1 of anomaly*
falsepositives:
   - Legitimate software that uses these patterns
level: medium

