Linux Process Discovery via grep/egrep Searching for Security/Monitoring Tools

Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.

FreeUnreviewedSigmalowv1

linux-process-discovery-via-grep-egrep-searching-for-security-monitoring-tools-c9d8b7fd

title: Linux Process Discovery via grep/egrep Searching for Security/Monitoring Tools
id: 546b64f5-ffbd-4a9a-b891-34f78508d6dc
status: test
description: This rule flags Linux process executions where grep or egrep command lines include strings associated with common security and monitoring software (e.g., Nessus, osqueryd, Carbon Black, CrowdStrike, and Elastic Beats). Attackers can use simple text-search utilities to quickly discover whether these tools are installed or running, helping them choose next steps and avoid detection. It relies on process creation telemetry, including the executed image path ending in /grep or /egrep and the command line contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-27
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /grep
      - /egrep
    CommandLine|contains:
      - nessusd
      - td-agent
      - packetbeat
      - filebeat
      - auditbeat
      - osqueryd
      - cbagentd
      - falcond
  condition: selection
falsepositives:
  - Legitimate activities
level: low
license: DRL-1.1
related:
  - id: c9d8b7fd-78e4-44fe-88f6-599135d46d60
    type: derived

What it detects

This rule flags Linux process executions where grep or egrep command lines include strings associated with common security and monitoring software (e.g., Nessus, osqueryd, Carbon Black, CrowdStrike, and Elastic Beats). Attackers can use simple text-search utilities to quickly discover whether these tools are installed or running, helping them choose next steps and avoid detection. It relies on process creation telemetry, including the executed image path ending in /grep or /egrep and the command line contents.

Known false positives

Legitimate activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.