Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Milad Cheraghi (SigmaHQ), DRL 1.1
Published: 2025-05-30
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1057Process Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes invoking the sysinfo system call, which returns a snapshot of system statistics such as uptime, load averages, memory usage, and process count. Such data is valuable to attackers performing reconnaissance or assessing whether a host is a viable target. It relies on auditd syscall telemetry that records SYSCALL type and the specific system call name.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Cisco AAA discovery via show/dir commands

Suspicious System Profiler Hardware Enumeration (via process_creation)

Antivirus Software Discovery via tasklist and findstr

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Linux sysinfo Syscall for System Information Discovery

Pivot detection · T1082 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-sysinfo-syscall-used-for-system-information-discovery-b207d563

title: Linux sysinfo Syscall for System Information Discovery
id: dc7a818d-c415-43bd-83a0-e1c7a815909f
status: experimental
description: This rule identifies Linux processes invoking the sysinfo system call, which returns a snapshot of system statistics such as uptime, load averages, memory usage, and process count. Such data is valuable to attackers performing reconnaissance or assessing whether a host is a viable target. It relies on auditd syscall telemetry that records SYSCALL type and the specific system call name.
references:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
  - https://man7.org/linux/man-pages/man2/sysinfo.2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-30
modified: 2025-12-05
tags:
  - attack.discovery
  - attack.t1057
  - attack.t1082
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall
    -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall
detection:
  selection:
    type: SYSCALL
    SYSCALL: sysinfo
  filter_optional_splunk:
    exe|endswith: /bin/splunkd
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: b207d563-a1d9-4275-b349-77d1eb55aa6d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL