Linux System Information Discovery via auditd: uname, uptime, lsmod, hostname, env

title: "Linux System Information Discovery via auditd: uname, uptime, lsmod, hostname, env"
id: 681bd37c-1251-4372-a286-9c0108aeec27
status: test
description: This rule flags Linux processes that access common system-identification files and execute typical system discovery commands such as uname, uptime, lsmod, hostname, env, grep (with virtualization keyword matching), and kmod list. Such behavior matters because attackers often enumerate host characteristics to guide follow-on actions and environmental targeting. It relies on auditd telemetry capturing execve arguments and file paths for /etc/lsb-release, /etc/redhat-release, and /etc/issue, along with command-line values that include virtualization-related terms.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_system_info_discovery.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-03
modified: 2023-03-06
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: linux
  service: auditd
detection:
  selection_1:
    type: PATH
    name:
      - /etc/lsb-release
      - /etc/redhat-release
      - /etc/issue
  selection_2:
    type: EXECVE
    a0:
      - uname
      - uptime
      - lsmod
      - hostname
      - env
  selection_3:
    type: EXECVE
    a0: grep
    a1|contains:
      - vbox
      - vm
      - xen
      - virtio
      - hv
  selection_4:
    type: EXECVE
    a0: kmod
    a1: list
  condition: 1 of selection_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: f34047d9-20d3-4e8b-8672-0a35cc50dc71
    type: derived