Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed
Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.
- Product
- linux
- Category
- process_creation
- Author
- Daniil Yugoslavskiy, oscd.community, CheraghiMilad (SigmaHQ), DRL 1.1
- Published
- 2020-10-19
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions of common system utilities used to enumerate files and directories, including recursive listings and filesystem/network mount discovery. Such discovery is frequently used during reconnaissance to map available paths, content, and shares before follow-on access attempts. It relies on process creation telemetry capturing the executed binary path (e.g., /find, /tree, /findmnt, /mlocate, /ls) and command-line arguments like -R or a very long command line pattern involving file output redirection.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed"
id: 56cbef61-8dd8-40cc-b8b9-68134ba1af10
status: test
description: This rule flags Linux process executions of common system utilities used to enumerate files and directories, including recursive listings and filesystem/network mount discovery. Such discovery is frequently used during reconnaissance to map available paths, content, and shares before follow-on access attempts. It relies on process creation telemetry capturing the executed binary path (e.g., /find, /tree, /findmnt, /mlocate, /ls) and command-line arguments like -R or a very long command line pattern involving file output redirection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule Team
date: 2020-10-19
modified: 2024-12-01
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_file_with_asterisk:
Image|endswith: /file
CommandLine|re: (.){200,}
selection_recursive_ls:
Image|endswith: /ls
CommandLine|contains: -R
selection_find_execution:
Image|endswith: /find
selection_tree_execution:
Image|endswith: /tree
selection_findmnt_execution:
Image|endswith: /findmnt
selection_locate_execution:
Image|endswith: /mlocate
condition: 1 of selection_*
falsepositives:
- Legitimate activities
level: informational
license: DRL-1.1
related:
- id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
type: derived