Linux sysinfo Syscall Used for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

FreeUnreviewedSigmalowv1

linux-sysinfo-syscall-used-for-system-information-discovery-b207d563

title: Linux sysinfo Syscall Used for System Information Discovery
id: dc7a818d-c415-43bd-83a0-e1c7a815909f
status: experimental
description: This rule flags execution of the Linux sysinfo system call as recorded by auditd. Attackers and reconnaissance tooling may use sysinfo to collect host characteristics such as uptime, load averages, memory usage, and process counts to help assess target viability. It relies on Linux auditd syscall telemetry for sysinfo on both 64-bit and 32-bit architectures, with a specific exclusion for the Splunk daemon path.
references:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
  - https://man7.org/linux/man-pages/man2/sysinfo.2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-30
modified: 2025-12-05
tags:
  - attack.discovery
  - attack.t1057
  - attack.t1082
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall
    -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall
detection:
  selection:
    type: SYSCALL
    SYSCALL: sysinfo
  filter_optional_splunk:
    exe|endswith: /bin/splunkd
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: b207d563-a1d9-4275-b349-77d1eb55aa6d
    type: derived

What it detects

This rule flags execution of the Linux sysinfo system call as recorded by auditd. Attackers and reconnaissance tooling may use sysinfo to collect host characteristics such as uptime, load averages, memory usage, and process counts to help assess target viability. It relies on Linux auditd syscall telemetry for sysinfo on both 64-bit and 32-bit architectures, with a specific exclusion for the Splunk daemon path.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.