Detects suspicious execution commands in Arch ALPM hooks

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging malicious Arch Linux ALPM hooks to execute unauthorized commands, a technique often used to establish persistence or evade detection by operating within package management workflows. Proactive hunting for this behavior in Azure Sentinel is critical because ALPM hook exploitation represents a sophisticated attack vector that can bypass traditional endpoint monitoring, requiring specialized log analysis to identify early-stage compromise on Linux-based workloads.

YARA Rule

rule SUSP_LNX_ARCH_ALPM_Hook_Jun26 {
   meta:
      description = "Detects suspicious execution commands in Arch ALPM hooks"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      hash = "ba332432f87e68d7fa8c784c60c39ba0d3e2ac06fd8855e82ea49329e2684529"
      score = 70
   strings:
      $s1 = "[Action]"
      $s2 = "Exec = "
      $s3 = "npm install "
      $s4 = "2>/dev/null"
   condition:
      filesize < 5KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects suspicious execution commands in Arch ALPM hooks” rule, along with suggested filters or exclusions:

Automated Post-Install Cleanup Scripts
- Scenario: System administrators often configure post-install hooks to run cleanup scripts (e.g., removing temporary build artifacts, clearing cache directories, or restarting specific services) immediately after a package installation. These scripts frequently invoke commands like systemctl restart, rm -rf, or custom Python/Shell utilities that may appear as “suspicious” external executions within the hook context.
- Filter/Exclusion: Exclude execution paths matching known cleanup script locations (e.g., /usr/local/lib/alpm/hooks/cleanup.sh) and whitelist specific command arguments such as systemctl restart or rm -rf /tmp/build-cache.
Scheduled Cron Jobs Triggering ALPM Updates
- Scenario: Enterprise environments often rely on cron jobs to perform nightly package updates using pacman -Syu. These scheduled tasks may trigger custom hooks that execute verification commands (e.g., running auditd checks or logging tools like jq) against the updated package database. The rule might flag these routine, time-based executions as anomalous because they occur outside of standard user interaction windows.
- Filter/Exclusion: Create an exclusion based on the parent process name (e.g., CRON or /usr/sbin/cron) and restrict the detection to business hours (08:00–18:00) or specific time windows where maintenance jobs are known to run.
CI/CD Pipeline Artifact Deployment
- Scenario: In DevOps environments, automated pipelines (using tools like Jenkins, GitLab CI, or GitHub Actions) frequently push custom Arch packages to servers. The deployment process invokes ALPM hooks that execute