Linux Container Discovery via /proc Virtual Filesystem Enumeration

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

FreeUnreviewedSigmalowv1

linux-container-discovery-via-proc-virtual-filesystem-enumeration-746c86fb

title: Linux Container Discovery via /proc Virtual Filesystem Enumeration
id: b79eaaa9-45ac-41bd-8ae9-0fb36ae98475
status: test
description: This rule identifies Linux process creation where common text-processing utilities (awk, cat, grep, head, less, more, nl, tail) are used in combination with accesses to /proc paths associated with kernel and process runtime discovery. Attackers may use /proc enumeration to determine whether they are running inside a container and to tailor subsequent actions. It relies on process creation telemetry capturing the command line so it can match tool usage and targeted /proc references such as /proc/2/ and /proc/* paths ending in /cgroup or /sched.
references:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml
tags:
  - attack.discovery
  - attack.t1082
author: Seth Hanford, Huntrule Team
date: 2023-08-23
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - awk
      - /cat
      - grep
      - /head
      - /less
      - /more
      - /nl
      - /tail
  selection_procfs_kthreadd:
    CommandLine|contains: /proc/2/
  selection_procfs_target:
    CommandLine|contains: /proc/
    CommandLine|endswith:
      - /cgroup
      - /sched
  condition: selection_tools and 1 of selection_procfs_*
falsepositives:
  - Legitimate system administrator usage of these commands
  - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low
license: DRL-1.1
related:
  - id: 746c86fb-ccda-4816-8997-01386263acc4
    type: derived

What it detects

This rule identifies Linux process creation where common text-processing utilities (awk, cat, grep, head, less, more, nl, tail) are used in combination with accesses to /proc paths associated with kernel and process runtime discovery. Attackers may use /proc enumeration to determine whether they are running inside a container and to tailor subsequent actions. It relies on process creation telemetry capturing the command line so it can match tool usage and targeted /proc references such as /proc/2/ and /proc/* paths ending in /cgroup or /sched.

Known false positives

Legitimate system administrator usage of these commands
Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.