Linux File and Directory Discovery via System Utilities Execution

title: Linux File and Directory Discovery via System Utilities Execution
id: 56cbef61-8dd8-40cc-b8b9-68134ba1af10
status: test
description: This rule flags process execution of common file and directory discovery utilities on Linux, including find, tree, findmnt, ls with recursive listing, and mlocate. Such activity can indicate an attacker enumerating the filesystem or related mount/share information to plan subsequent access. It relies on process creation telemetry capturing the executable path and command-line arguments such as recursive flags or specific patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule Team
date: 2020-10-19
modified: 2024-12-01
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_file_with_asterisk:
    Image|endswith: /file
    CommandLine|re: (.){200,}
  selection_recursive_ls:
    Image|endswith: /ls
    CommandLine|contains: -R
  selection_find_execution:
    Image|endswith: /find
  selection_tree_execution:
    Image|endswith: /tree
  selection_findmnt_execution:
    Image|endswith: /findmnt
  selection_locate_execution:
    Image|endswith: /mlocate
  condition: 1 of selection_*
falsepositives:
  - Legitimate activities
level: informational
license: DRL-1.1
related:
  - id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
    type: derived