Linux Process Discovery via Common CLI Enumeration Tools

Flags Linux execution of common tools used to enumerate running processes.

FreeUnreviewedSigmalowv1

linux-process-discovery-via-common-cli-enumeration-tools-4e2f5868

title: Linux Process Discovery via Common CLI Enumeration Tools
id: d4f8f898-e336-4b42-9050-67074b3258ee
status: stable
description: This rule matches Linux process creation events where the executed binary path ends with common process discovery utilities such as atop, htop, pgrep, ps, pstree, and top. Attackers use these commands to enumerate running processes and infer what software is active on a host. The detection relies on process creation telemetry that includes the command image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md
  - https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_running_process_discovery.yml
author: Ömer Günal, oscd.community, CheraaghiMilad, Huntrule Team
date: 2020-10-06
modified: 2022-07-07
tags:
  - attack.discovery
  - attack.t1057
  - detection.threat-hunting
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /atop
      - /htop
      - /pgrep
      - /ps
      - /pstree
      - /top
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 4e2f5868-08d4-413d-899f-dc2f1508627b
    type: derived

What it detects

This rule matches Linux process creation events where the executed binary path ends with common process discovery utilities such as atop, htop, pgrep, ps, pstree, and top. Attackers use these commands to enumerate running processes and infer what software is active on a host. The detection relies on process creation telemetry that includes the command image path.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.