Suspicious Package Installed - Linux

Hunt Hypothesis

Detects installation of suspicious packages using system installation utilities

Detection Rule

Sigma (Original)

title: Suspicious Package Installed - Linux
id: 700fb7e8-2981-401c-8430-be58e189e741
status: test
description: Detects installation of suspicious packages using system installation utilities
references:
    - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-03
modified: 2026-01-01
tags:
    - attack.defense-evasion
    - attack.t1553.004
logsource:
    product: linux
    category: process_creation
detection:
    selection_tool_apt:
        Image|endswith:
            - '/apt'
            - '/apt-get'
        CommandLine|contains: 'install'
    selection_tool_yum:
        Image|endswith: '/yum'
        CommandLine|contains:
            - 'localinstall'
            - 'install'
    selection_tool_rpm:
        Image|endswith: '/rpm'
        CommandLine|contains: '-i'
    selection_tool_dpkg:
        Image|endswith: '/dpkg'
        CommandLine|contains:
            - '--install'
            - '-i'
    selection_keyword:
        CommandLine|contains:
            # Add more suspicious packages
            - 'nmap'
            - ' nc'
            - 'netcat'
            - 'wireshark'
            - 'tshark'
            - 'openconnect'
            - 'proxychains'
            - 'socat'
    condition: 1 of selection_tool_* and selection_keyword
falsepositives:
    - Legitimate administration activities
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (((TargetProcessName endswith "/apt" or TargetProcessName endswith "/apt-get") and TargetProcessCommandLine contains "install") or (TargetProcessName endswith "/yum" and (TargetProcessCommandLine contains "localinstall" or TargetProcessCommandLine contains "install")) or (TargetProcessName endswith "/rpm" and TargetProcessCommandLine contains "-i") or (TargetProcessName endswith "/dpkg" and (TargetProcessCommandLine contains "--install" or TargetProcessCommandLine contains "-i"))) and (TargetProcessCommandLine contains "nmap" or TargetProcessCommandLine contains " nc" or TargetProcessCommandLine contains "netcat" or TargetProcessCommandLine contains "wireshark" or TargetProcessCommandLine contains "tshark" or TargetProcessCommandLine contains "openconnect" or TargetProcessCommandLine contains "proxychains" or TargetProcessCommandLine contains "socat")

Required Data Sources

False Positive Guidance

• Legitimate administration activities

MITRE ATT&CK Context

• Tactic: Defense Evasion
• Technique: T1553.004 — Install Root Certificate

  Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to ident

Validation (Atomic Red Team)

Use these Atomic Red Team tests to validate this detection fires correctly:

• T1553.004 — Install Root Certificate

References

• https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
• SigmaHQ Rule