Linux System Network Connections Discovery via who/w/last/lsof/netstat

title: Linux System Network Connections Discovery via who/w/last/lsof/netstat
id: a768833b-2a47-405a-abc6-4c2a3de254b8
status: test
description: This rule flags process executions of common Linux utilities used to enumerate system network connections and related system sessions. Attackers may run these commands during discovery to identify listening services, active connections, or logged-in users before further exploitation. It relies on process creation telemetry and matches the invoked command path by its executable suffix, excluding executions spawned from the landscape-sysinfo parent command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2023-01-17
tags:
  - attack.discovery
  - attack.t1049
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /who
      - /w
      - /last
      - /lsof
      - /netstat
  filter_landscape_sysinfo:
    ParentCommandLine|contains: /usr/bin/landscape-sysinfo
    Image|endswith: /who
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate activities
level: low
license: DRL-1.1
related:
  - id: 4c519226-f0cd-4471-bd2f-6fbb2bb68a79
    type: derived