Linux Process Command-Line Inode/Directory Listing for Container Discovery

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.

FreeUnreviewedSigmalowv1

linux-process-command-line-inode-directory-listing-for-container-discovery-43e26eb5

title: Linux Process Command-Line Inode/Directory Listing for Container Discovery
id: 1a59a5e4-1789-4c2d-99bb-b9337ce601d1
status: test
description: This rule flags Linux process executions where the command line indicates listing inodes for the root directory ('/'), using flags related to inode numbers and directory selection. Attackers and tooling may perform this type of environment probing to determine whether they are running inside a container before choosing follow-on actions. Telemetry relies on process creation events and matches specific command-line patterns that end with the inode-listing utility and include arguments targeting '/' along with inode/directory options.
references:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml
tags:
  - attack.discovery
  - attack.t1082
author: Seth Hanford, Huntrule Team
date: 2023-08-23
modified: 2025-11-24
logsource:
  category: process_creation
  product: linux
detection:
  selection_ls_img:
    Image|endswith: /ls
  selection_ls_cli:
    - CommandLine|endswith: " /"
    - CommandLine|contains: " / "
  selection_regex_inode:
    CommandLine|re: (?:\s-[^-\s]{0,20}i|\s--inode\s)
  selection_regex_dir:
    CommandLine|re: (?:\s-[^-\s]{0,20}d|\s--directory\s)
  condition: all of selection_*
falsepositives:
  - Legitimate system administrator usage of these commands
  - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low
license: DRL-1.1
related:
  - id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8
    type: derived

What it detects

This rule flags Linux process executions where the command line indicates listing inodes for the root directory ('/'), using flags related to inode numbers and directory selection. Attackers and tooling may perform this type of environment probing to determine whether they are running inside a container before choosing follow-on actions. Telemetry relies on process creation events and matches specific command-line patterns that end with the inode-listing utility and include arguments targeting '/' along with inode/directory options.

Known false positives

Legitimate system administrator usage of these commands
Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.