Linux System and Hardware Information Discovery via File Reads

Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.

FreeUnreviewedSigmainformationalv1

linux-system-and-hardware-information-discovery-via-file-reads-1f358e2e

title: Linux System and Hardware Information Discovery via File Reads
id: 5c145078-1848-4604-b05b-cd812a97ec17
related:
  - id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239
    type: derived
  - id: 1f358e2e-cb63-43c3-b575-dfb072a6814f
    type: derived
status: stable
description: This rule flags attempts to access common files that expose system and hardware identifiers on Linux, including DMI/BIOS fields, storage model information, kernel version, and distribution release/issue files. Attackers use this reconnaissance to profile the host environment for tailoring subsequent actions. It relies on auditd telemetry that records file path access matching the listed system and release locations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-4---linux-vm-check-via-hardware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_system_info_discovery2.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2022-11-26
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name:
      - /sys/class/dmi/id/bios_version
      - /sys/class/dmi/id/product_name
      - /sys/class/dmi/id/chassis_vendor
      - /proc/scsi/scsi
      - /proc/ide/hd0/model
      - /proc/version
      - /etc/*version
      - /etc/*release
      - /etc/issue
  condition: selection
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1

What it detects

This rule flags attempts to access common files that expose system and hardware identifiers on Linux, including DMI/BIOS fields, storage model information, kernel version, and distribution release/issue files. Attackers use this reconnaissance to profile the host environment for tailoring subsequent actions. It relies on auditd telemetry that records file path access matching the listed system and release locations.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.