Linux Execution of Network Scanning and Recon Tools

title: Linux Execution of Network Scanning and Recon Tools
id: 4f45085c-e05a-4ce2-a6ba-d2174205cef3
status: test
description: This rule identifies process executions on Linux where the binary filename ends with common network scanning or reconnaissance tool names (including nc/ncat/netcat/socat and nmap/naabu/autorecon/hping and related utilities). Attackers use these tools to enumerate local or remote network services and probe connectivity prior to further activity. The detection relies on Linux process creation telemetry and matches the executable path and, for netcat-style tools, excludes cases that include explicit listen flags.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
  - https://github.com/projectdiscovery/naabu
  - https://github.com/Tib3rius/AutoRecon
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml
author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]), Huntrule Team
date: 2020-10-21
modified: 2024-09-19
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: linux
detection:
  selection_netcat:
    Image|endswith:
      - /nc
      - /ncat
      - /netcat
      - /socat
  selection_network_scanning_tools:
    Image|endswith:
      - /autorecon
      - /hping
      - /hping2
      - /hping3
      - /naabu
      - /nmap
      - /nping
      - /telnet
      - /zenmap
  filter_main_netcat_listen_flag:
    CommandLine|contains:
      - " --listen "
      - " -l "
  condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 3e102cd9-a70d-4a7a-9508-403963092f31
    type: derived