Linux Reconnaissance Indicators: .htpasswd and SUID/SGID File Search

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.