Linux System Network Connections Discovery via who, w, last, lsof, or netstat

Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.

FreeReviewedSigma · Low · v2

Product: linux
Category: process_creation
Author: Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-19
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1049System Network Connections Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process executions of common system utilities used to enumerate active network connections and system session state, including who, w, last, lsof, and netstat. Attackers may use these commands to recon a host, understand service usage, or identify exposed connections. Detection relies on process creation telemetry and matches executable paths by filename suffix, while excluding executions spawned from the landscape-sysinfo utility.

Reporting behind it

Related detections9 linkedT1049 — drag to rearrange

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows Process Creation Signals for Pikabot System Discovery

Windows Net.exe Network Connections Discovery via Use Sessions Query

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

macOS System Network Connection Discovery via who, w, last, lsof, or netstat

Cisco AAA discovery via show/dir commands

Linux System Network Connections Discovery via who, w, last, lsof, or netstat

Pivot detection · T1049 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-system-network-connections-discovery-via-who-w-last-lsof-netstat-4c519226

title: Linux System Network Connections Discovery via who, w, last, lsof, or netstat
id: a768833b-2a47-405a-abc6-4c2a3de254b8
status: test
description: This rule identifies Linux process executions of common system utilities used to enumerate active network connections and system session state, including who, w, last, lsof, and netstat. Attackers may use these commands to recon a host, understand service usage, or identify exposed connections. Detection relies on process creation telemetry and matches executable paths by filename suffix, while excluding executions spawned from the landscape-sysinfo utility.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2023-01-17
tags:
  - attack.discovery
  - attack.t1049
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /who
      - /w
      - /last
      - /lsof
      - /netstat
  filter_landscape_sysinfo:
    ParentCommandLine|contains: /usr/bin/landscape-sysinfo
    Image|endswith: /who
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate activities
level: low
license: DRL-1.1
related:
  - id: 4c519226-f0cd-4471-bd2f-6fbb2bb68a79
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL