Linux System Information Discovery via Common System Command Execution

Flags Linux executions of uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod for system discovery behavior.

FreeUnreviewedSigmainformationalv1

linux-system-information-discovery-via-common-system-command-execution-42df45e7

title: Linux System Information Discovery via Common System Command Execution
id: 4354fd04-31f5-40bf-9700-fbb6ba9ed102
status: stable
description: This rule identifies process executions where the command image ends with common system information utilities such as uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod. System discovery helps attackers quickly profile hardware and OS characteristics for follow-on actions and target selection. It relies on Linux process creation telemetry that captures the executable path used for these commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2021-09-14
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /uname
      - /hostname
      - /uptime
      - /lspci
      - /dmidecode
      - /lscpu
      - /lsmod
  condition: selection
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239
    type: derived

What it detects

This rule identifies process executions where the command image ends with common system information utilities such as uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod. System discovery helps attackers quickly profile hardware and OS characteristics for follow-on actions and target selection. It relies on Linux process creation telemetry that captures the executable path used for these commands.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.