name: linux_tool_discovery_process
id: f0d8b1c8-4ca0-4765-858a-ab0dea68c399
version: 3
creation_date: '2022-02-16'
modification_date: '2026-05-13'
author: Splunk Threat Research Team
lookup_type: csv
description: A list of suspicious bash commonly used by attackers via scripts
match_type:
    - WILDCARD(process)
min_matches: 1
case_sensitive_match: false