Linux Process Discovery by Listing .dockerenv via Common File Utilities

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

FreeUnreviewedSigmalowv1

linux-process-discovery-by-listing-dockerenv-via-common-file-utilities-11701de9

title: Linux Process Discovery by Listing .dockerenv via Common File Utilities
id: 7980b30e-34d1-40e9-8083-9d9e72b56a5f
status: test
description: This rule flags Linux process executions that invoke common file inspection utilities and target the hidden Docker environment file by matching command lines ending with ".dockerenv". Attackers can use this to determine whether a process is running inside a container and adjust their behavior accordingly. Telemetry relies on process creation events, including the executable image path/name and the full command line ending with ".dockerenv".
references:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml
tags:
  - attack.discovery
  - attack.t1082
author: Seth Hanford, Huntrule Team
date: 2023-08-23
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /cat
      - /dir
      - /find
      - /ls
      - /stat
      - /test
      - grep
    CommandLine|endswith: .dockerenv
  condition: selection
falsepositives:
  - Legitimate system administrator usage of these commands
  - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low
license: DRL-1.1
related:
  - id: 11701de9-d5a5-44aa-8238-84252f131895
    type: derived

What it detects

This rule flags Linux process executions that invoke common file inspection utilities and target the hidden Docker environment file by matching command lines ending with ".dockerenv". Attackers can use this to determine whether a process is running inside a container and adjust their behavior accordingly. Telemetry relies on process creation events, including the executable image path/name and the full command line ending with ".dockerenv".

Known false positives

Legitimate system administrator usage of these commands
Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.