Linux: Shell Invocation via Env Command
The env command can be used to invoke a system shell, which may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 16:12 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The env command, typically used to set or modify environment variables, can be used to invoke a shell. This technique is documented in GTFOBins as a method to spawn a shell.
Recommendation
Deploy the provided Sigma rule to detect the use of the env command to invoke a shell. Monitor for legitimate system operations that may trigger this alert, such as Github operations (e.g., ghe-backup).
Detection coverage 1
Shell Invocation via Env Command - Linux
highDetects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Detection queries are available on the platform. Get full rules →