[LINUX-SECURITY] Suspicious Command (/proc/<PID>/cmdline)

alert any $HOME_NET any -> $HOME_NET any (msg:"[LINUX-SECURITY] Suspicious Command (/proc/<PID>/cmdline)"; content:"/proc/"; content:"/cmdline" reference:url,https://blog.apnic.net/2019/10/14/how-to-basic-linux-malware-process-forensics-for-incident-responders/; classtype:trojan-activity; sid:5014633; rev:1; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2024_01_25, updated_at 2024_01_25, mitre_tactic_id TA0007, mitre_technique_id T1087;)