Suspicious C2 Related Command Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 18, 2025•1•0•33

Detects the execution of suspicious commands often used in Command and Control (C2) activities, as identified in Florian Roth's 'Best Practice Auditd Configuration'. These commands include `wget`, `curl`, `base64`, `nc`, `netcat`, `ncat`, `ssh`, `socat`, `wireshark`, `rawshark`, `rdesktop`, and `nmap`. These tools can be leveraged for various adversarial techniques such as data transfer, remote access, network discovery, and data encoding.