Linux Local System Groups Enumeration via groups/cat to /etc/group

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

FreeUnreviewedSigmalowv1

linux-local-system-groups-enumeration-via-groups-cat-to-etc-group-676381a6

title: Linux Local System Groups Enumeration via groups/cat to /etc/group
id: 45ec4608-dc99-4fd0-b300-2512e62d47d5
status: test
description: This rule flags process executions that appear to enumerate local system groups, either by running the groups command or by reading /etc/group using common text viewers/editors. Discovering group membership and permission-related data can help an attacker map local access boundaries and identify privilege opportunities. The detection relies on Linux process creation telemetry, matching the executable path suffix and specific command-line content indicating access to /etc/group.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_local_groups.yml
author: Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2025-06-04
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_1:
    Image|endswith: /groups
  selection_2:
    Image|endswith:
      - /cat
      - /ed
      - /head
      - /less
      - /more
      - /nano
      - /tail
      - /vi
      - /vim
    CommandLine|contains: /etc/group
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 676381a6-15ca-4d73-a9c8-6a22e970b90d
    type: derived

What it detects

This rule flags process executions that appear to enumerate local system groups, either by running the groups command or by reading /etc/group using common text viewers/editors. Discovering group membership and permission-related data can help an attacker map local access boundaries and identify privilege opportunities. The detection relies on Linux process creation telemetry, matching the executable path suffix and specific command-line content indicating access to /etc/group.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.