LoFP LoFP / legitimate workflows may launch unix command interpreters from browser contexts, including developer tooling, software installers, sso helpers, browser extensions, and automation wrappers. tuning may be required for approved applications, users, and destinations.

Techniques

Sample rules

Cisco NVM - Browser Spawned Unix Shell with External Connection

Description

Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.

Detection logic

`cisco_network_visibility_module_flowdata`
process_path IN (
    "*/bash",
    "*/csh",
    "*/dash",
    "*/fish",
    "*/sh",
    "*/tcsh",
    "*/zsh"
)
parent_process_path IN (
    "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin",
    "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera",
    "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox"
)
NOT dest IN (
        "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
        "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
        "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
        "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
        "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
    )


| stats count
    min(_time) as firstTime
    max(_time) as lastTime
    values(parent_process_hash) as parent_process_hash
    values(process_hash) as process_hash
    values(module_name_list) as module_name_list
    values(module_hash_list) as module_hash_list
    values(dest_port) as dest_port
    values(dest_hostname) as dest_hostname

  by src src_ip dest dest_ip bytes_in bytes_out
     user process_id process_name process_path process
     parent_process_id parent_process_name parent_process_path parent_process


| table
  firstTime lastTime user
  parent_process_path parent_process_name parent_process parent_process_hash
  process_path process_name process process_hash process_id
  module_name_list module_hash_list
  src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter`