Root Shell Spawned via GTFOBin-like Parent (Linux, DeviceProcessEvents)
Detects potential GTFOBins abuse on Linux systems where a root shell is spawned by a suspicious parent process (e.g., find, perl, vim, tar, etc.). This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available. Note: This detection does not cover all GTFOBins. It focuses specifically on cases where: - A root-owned shell is spawned - The parent process is known to be capable of shell escape or privilege abuse - The child command appears interactive or escape-like It does not detect: - Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.) - GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via misconfigured capabilities) - Abuse of GTFOBins run under non-root accounts The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
Microsoft Sentinel (KQL)
