Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed

title: "Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed"
id: 56cbef61-8dd8-40cc-b8b9-68134ba1af10
status: test
description: This rule flags Linux process executions of common system utilities used to enumerate files and directories, including recursive listings and filesystem/network mount discovery. Such discovery is frequently used during reconnaissance to map available paths, content, and shares before follow-on access attempts. It relies on process creation telemetry capturing the executed binary path (e.g., /find, /tree, /findmnt, /mlocate, /ls) and command-line arguments like -R or a very long command line pattern involving file output redirection.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule Team
date: 2020-10-19
modified: 2024-12-01
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_file_with_asterisk:
    Image|endswith: /file
    CommandLine|re: (.){200,}
  selection_recursive_ls:
    Image|endswith: /ls
    CommandLine|contains: -R
  selection_find_execution:
    Image|endswith: /find
  selection_tree_execution:
    Image|endswith: /tree
  selection_findmnt_execution:
    Image|endswith: /findmnt
  selection_locate_execution:
    Image|endswith: /mlocate
  condition: 1 of selection_*
falsepositives:
  - Legitimate activities
level: informational
license: DRL-1.1
related:
  - id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
    type: derived