Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed

Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.

FreeReviewedSigma · Informational · v3
Product
linux
Category
process_creation
Author
Daniil Yugoslavskiy, oscd.community, CheraghiMilad (SigmaHQ), DRL 1.1
Published
2020-10-19
Updated
2026-07-31

ATT&CK techniques

Discovery
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags Linux process executions of common system utilities used to enumerate files and directories, including recursive listings and filesystem/network mount discovery. Such discovery is frequently used during reconnaissance to map available paths, content, and shares before follow-on access attempts. It relies on process creation telemetry capturing the executed binary path (e.g., /find, /tree, /findmnt, /mlocate, /ls) and command-line arguments like -R or a very long command line pattern involving file output redirection.

Related detections9 linkedT1083 — drag to rearrange
Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config
PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch
Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Windows: Notepad Password File Discovery via Process Creation
Linux process execution of shell via nice utility
Linux: Shell Command Execution Using flock -u with Common Shell Paths
Linux Find Command Used to Execute a Shell via -exec
Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed
Pivot detection · T1083 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.