Shell Invocation via Env Command - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•3•0•23

Detects the use of the 'env' command to invoke a shell on Linux systems. This activity can indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands by manipulating environment variables before launching a shell.