Attack.t1083 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/attack.t1083/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 11:39:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux: Shell execution via find commandhttps://feed.craftedsignal.io/briefs/2026-11-linux-find-exec/Wed, 11 Nov 2026 11:39:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linux-find-exec/Detection of the use of the find command to execute a shell, which may be associated with privilege escalation, unauthorized command execution, or exploitation attempts.The find command in Linux environments can be used to execute a shell. This behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempts. This detection focuses on process creation events where the find command is executed with the '-exec' flag in conjunction with common shell binaries.

Detection Logic

The detection identifies the execution of the 'find' binary where the command line contains the '-exec' argument and references to common shells (/bin/bash, /bin/dash, /bin/fish, /bin/sh, or /bin/zsh).

]]>highadvisoryattack.discoveryattack.t1083