Linux Process Discovery of Container Environment via ls -i on / Directory
Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.
- Product
- linux
- Category
- process_creation
- Author
- Seth Hanford (SigmaHQ), DRL 1.1
- Published
- 2023-08-23
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of the 'ls' command with options used to list inode information for the root directory ('/'), which can be used to infer whether the system is running inside a container. Attackers may use this environment checks to adjust behavior, select appropriate exploits, or avoid analysis. The detection relies on process creation telemetry, specifically matching command-line patterns indicating 'ls' usage with directory and inode-related flags and a target of '/'.
Reporting behind it
- blog.skyplabs.nethttps://blog.skyplabs.net/posts/container-detection/
- stackoverflow.comhttps://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Discovery of Container Environment via ls -i on / Directory
id: 1a59a5e4-1789-4c2d-99bb-b9337ce601d1
status: test
description: This rule identifies process executions of the 'ls' command with options used to list inode information for the root directory ('/'), which can be used to infer whether the system is running inside a container. Attackers may use this environment checks to adjust behavior, select appropriate exploits, or avoid analysis. The detection relies on process creation telemetry, specifically matching command-line patterns indicating 'ls' usage with directory and inode-related flags and a target of '/'.
references:
- https://blog.skyplabs.net/posts/container-detection/
- https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml
tags:
- attack.discovery
- attack.t1082
author: Seth Hanford, Huntrule Team
date: 2023-08-23
modified: 2025-11-24
logsource:
category: process_creation
product: linux
detection:
selection_ls_img:
Image|endswith: /ls
selection_ls_cli:
- CommandLine|endswith: " /"
- CommandLine|contains: " / "
selection_regex_inode:
CommandLine|re: (?:\s-[^-\s]{0,20}i|\s--inode\s)
selection_regex_dir:
CommandLine|re: (?:\s-[^-\s]{0,20}d|\s--directory\s)
condition: all of selection_*
falsepositives:
- Legitimate system administrator usage of these commands
- Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low
license: DRL-1.1
related:
- id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8
type: derived