Shell Execution via Nice Utility on Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•2•0•22

This rule detects the execution of shell programs (bash, dash, fish, sh, zsh) using the 'nice' utility on Linux systems. This behavior can be indicative of an adversary attempting to escalate privileges, execute unauthorized commands, or break out of restricted environments by manipulating process priority.