Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

FreeReviewedSigma · Low · v2

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-06-02
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process executions where the binary name ends with '/grep' and the command line ends with architecture identifiers such as aarch64, arm, i386, i686, mips, or x86_64. Attackers use this kind of quick local system profiling to determine compatibility before payload selection or follow-on actions. It relies on process creation telemetry that includes the process image path and the full command line.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Suspicious Security Policy Export via SecEdit (via process_creation)

Linux OS Architecture Discovery Using grep

Pivot detection · T1082 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-os-architecture-discovery-using-grep-for-cpu-arch-strings-d27ab432

title: Linux OS Architecture Discovery Using grep
id: aafd3b85-9b70-4d5b-8193-df9741e49584
status: test
description: This rule flags Linux process executions where the binary name ends with '/grep' and the command line ends with architecture identifiers such as aarch64, arm, i386, i686, mips, or x86_64. Attackers use this kind of quick local system profiling to determine compatibility before payload selection or follow-on actions. It relies on process creation telemetry that includes the process image path and the full command line.
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith: /grep
  selection_architecture:
    CommandLine|endswith:
      - aarch64
      - arm
      - i386
      - i686
      - mips
      - x86_64
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d27ab432-2199-483f-a297-03633c05bae6
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL