Suspicious Command Execution on Linux

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•2

This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.