huntrule

Linux process discovery via grep/egrep searching for security software strings

Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.

FreeReviewedSigma · Low · v2
Product
linux
Category
process_creation
Author
Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process executions where the binary name ends with /grep or /egrep and the command line contains one of several strings associated with security and telemetry software. Attackers may use simple text-search utilities to enumerate installed tools (e.g., vulnerability scanners, log shippers, monitoring/agent processes) during discovery. It relies on process creation telemetry that includes the executable path and full command line.

Reporting behind it

Related detections9 linkedT1518.001 — drag to rearrange
Suspicious Antivirus Enumeration via WMIC SecurityCenter2
Suspicious Security Product Discovery via tasklist and findstr (via process_creation)
Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)
Suspicious Defender and Session Reconnaissance via sc query and quser
Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)
Suspicious Antivirus Product Discovery via WMIC SecurityCenter2 Query
Antivirus Software Discovery via tasklist and findstr
Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)
Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)
Linux process discovery via grep/egrep searching for security software strings
Pivot detection · T1518.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.