2022-09-14 10:36:58 +00:00
|
|
|
|
id: bash-scanner
|
|
|
|
|
|
|
|
|
|
info:
|
2022-09-19 09:27:53 +00:00
|
|
|
|
name: Bash Scanner
|
2022-09-14 10:36:58 +00:00
|
|
|
|
author: ransomsec
|
|
|
|
|
severity: info
|
2022-09-19 09:27:53 +00:00
|
|
|
|
description: Indicator for bash Dangerous Commands – You Should Never Execute on Linux
|
2022-09-14 10:36:58 +00:00
|
|
|
|
reference:
|
2022-09-19 09:27:53 +00:00
|
|
|
|
- https://www.tecmint.com/10-most-dangerous-commands-you-should-never-execute-on-linux/
|
|
|
|
|
- https://phoenixnap.com/kb/dangerous-linux-terminal-commands
|
2023-04-14 14:22:36 +00:00
|
|
|
|
tags: bash,file,shell,sh
|
2023-12-14 03:56:01 +00:00
|
|
|
|
|
2022-09-14 10:36:58 +00:00
|
|
|
|
file:
|
|
|
|
|
- extensions:
|
2022-09-19 09:27:53 +00:00
|
|
|
|
- sh
|
2022-09-14 10:36:58 +00:00
|
|
|
|
|
|
|
|
|
extractors:
|
|
|
|
|
- type: regex
|
|
|
|
|
name: fork-bomb
|
|
|
|
|
regex:
|
|
|
|
|
- ":(){:|:&};:"
|
|
|
|
|
|
|
|
|
|
- type: regex
|
2022-09-29 13:38:41 +00:00
|
|
|
|
name: rm command found
|
2022-09-14 10:36:58 +00:00
|
|
|
|
regex:
|
|
|
|
|
- "rm -(f|r)"
|
|
|
|
|
- "rm -(fr|rf)"
|
|
|
|
|
|
|
|
|
|
- type: regex
|
|
|
|
|
name: code injection
|
|
|
|
|
regex:
|
|
|
|
|
- "/bin/(sh|bash) -"
|
|
|
|
|
- "eval"
|
|
|
|
|
- "echo -c"
|
|
|
|
|
- "/bin/(sh|bash) -c"
|
|
|
|
|
- "(sh|bash) -"
|
|
|
|
|
- "(sh|bash) -c"
|
|
|
|
|
|
|
|
|
|
- type: regex
|
|
|
|
|
name: file manipulation
|
|
|
|
|
regex:
|
|
|
|
|
- "cat /dev/null >"
|
|
|
|
|
|
|
|
|
|
- type: regex
|
2022-09-19 09:27:53 +00:00
|
|
|
|
name: unknown filedownload
|
2022-09-14 10:36:58 +00:00
|
|
|
|
regex:
|
|
|
|
|
- '(wget|curl) (https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]\.[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]$'
|
2024-01-04 06:57:22 +00:00
|
|
|
|
# digest: 4a0a004730450221009ad4de0abc82c172ead956fa70e1a84b3baff31c544569a254f7cf7d255e41cf02200bae7cf84580e9b008236464ea25f105d51c97951521af9c5e96b3ca11a1ad48:922c64590222798bb761d5b6d8e72950
|