Susp AWK Command Execution

Danny Y@zendannyy

•updated Apr 29, 2026•0•288

This rule detects suspicious execution of the 'awk' command on Linux systems. Specifically, it looks for 'awk' commands that include suspicious patterns. This pattern is often indicative of malicious script execution or code injection attempts using 'awk' for arbitrary command execution.