Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools
Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.
- Product
- linux
- Category
- process_creation
- Author
- Seth Hanford (SigmaHQ), DRL 1.1
- Published
- 2023-08-23
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions that use common text-processing utilities (awk, cat, grep, head, less, more, nl, tail) while their command line references kernel feature paths under the /proc virtual filesystem. Adversaries often probe /proc to determine whether they are running inside a container, which can influence evasion and follow-on actions. The detection relies on Linux process creation telemetry and matches specific /proc path patterns in the command line.
Reporting behind it
- blog.skyplabs.nethttps://blog.skyplabs.net/posts/container-detection/
- stackoverflow.comhttps://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools
id: b79eaaa9-45ac-41bd-8ae9-0fb36ae98475
status: test
description: This rule identifies process executions that use common text-processing utilities (awk, cat, grep, head, less, more, nl, tail) while their command line references kernel feature paths under the /proc virtual filesystem. Adversaries often probe /proc to determine whether they are running inside a container, which can influence evasion and follow-on actions. The detection relies on Linux process creation telemetry and matches specific /proc path patterns in the command line.
references:
- https://blog.skyplabs.net/posts/container-detection/
- https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml
tags:
- attack.discovery
- attack.t1082
author: Seth Hanford, Huntrule Team
date: 2023-08-23
logsource:
category: process_creation
product: linux
detection:
selection_tools:
Image|endswith:
- awk
- /cat
- grep
- /head
- /less
- /more
- /nl
- /tail
selection_procfs_kthreadd:
CommandLine|contains: /proc/2/
selection_procfs_target:
CommandLine|contains: /proc/
CommandLine|endswith:
- /cgroup
- /sched
condition: selection_tools and 1 of selection_procfs_*
falsepositives:
- Legitimate system administrator usage of these commands
- Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low
license: DRL-1.1
related:
- id: 746c86fb-ccda-4816-8997-01386263acc4
type: derived