Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Milad Cheraghi (SigmaHQ), DRL 1.1
Published: 2025-05-30
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1057Process Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes invoking the sysinfo system call, which returns a snapshot of system statistics such as uptime, load averages, memory usage, and process count. Such data is valuable to attackers performing reconnaissance or assessing whether a host is a viable target. It relies on auditd syscall telemetry that records SYSCALL type and the specific system call name.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Cisco AAA discovery via show/dir commands

Suspicious Container Environment Discovery via Proc Cgroup

Suspicious Doenerium Host Fingerprinting via cmd.exe

Suspicious Windows Defender Support Directory Enumeration via Process Creation

Suspicious System Reconnaissance via Windows Script Host

Suspicious Host Reconnaissance Command Chain via cmd

Malicious DinodasRAT Hidden Config File Creation on Linux (via file_event)

Linux sysinfo Syscall for System Information Discovery

Pivot detection · T1082 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-sysinfo-syscall-used-for-system-information-discovery-b207d563

title: Linux sysinfo Syscall for System Information Discovery
id: dc7a818d-c415-43bd-83a0-e1c7a815909f
status: experimental
description: This rule identifies Linux processes invoking the sysinfo system call, which returns a snapshot of system statistics such as uptime, load averages, memory usage, and process count. Such data is valuable to attackers performing reconnaissance or assessing whether a host is a viable target. It relies on auditd syscall telemetry that records SYSCALL type and the specific system call name.
references:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
  - https://man7.org/linux/man-pages/man2/sysinfo.2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-30
modified: 2025-12-05
tags:
  - attack.discovery
  - attack.t1057
  - attack.t1082
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall
    -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall
detection:
  selection:
    type: SYSCALL
    SYSCALL: sysinfo
  filter_optional_splunk:
    exe|endswith: /bin/splunkd
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: b207d563-a1d9-4275-b349-77d1eb55aa6d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL