huntrule

Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads

Triggers on auditd events showing host enumeration commands and system identity file access on Linux.

FreeReviewedSigma · Low · v3
Product
linux
Service
auditd
Author
Pawel Mazur (SigmaHQ), DRL 1.1
Published
2021-09-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux processes and file access indicative of system information discovery, including reads of common release/issue files and execution of utilities such as uname, uptime, lsmod, hostname, env, and kmod list. It also matches grep output patterns that may reveal virtualization or hypervisor-related strings (e.g., vbox, vm, xen, virtio, hv). These actions can help an attacker profile a host for targeting decisions, and the detection relies on auditd telemetry for file PATH access and execve command arguments.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange
Suspicious System Profiler Hardware Enumeration (via process_creation)
Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)
Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)
Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script
Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json
Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)
Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server
Suspicious macOS Download History Query via sqlite3
Suspicious Security Policy Export via SecEdit (via process_creation)
Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads
Pivot detection · T1082 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.