Linux System Network Discovery via Firewall, Netstat/Route, and Interface Commands

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

FreeUnreviewedSigmainformationalv1

linux-system-network-discovery-via-firewall-netstat-route-and-interface-commands-e7bd1cfa

title: Linux System Network Discovery via Firewall, Netstat/Route, and Interface Commands
id: 2ae66ec9-b25f-4703-bdc1-4b9db1d517c9
status: test
description: This rule flags process executions of common Linux networking and firewall utilities used to enumerate local network configuration and routing. Attackers often run these commands to identify available interfaces, DNS settings, and connectivity paths before further discovery or exploitation. It relies on Linux process creation telemetry matching specific executable name endings and a command line string referencing /etc/resolv.conf.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml
author: Ömer Günal and remotephone, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-09-15
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /firewall-cmd
      - /ufw
      - /iptables
      - /netstat
      - /ss
      - /ip
      - /ifconfig
      - /systemd-resolve
      - /route
  selection_cli:
    CommandLine|contains: /etc/resolv.conf
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
    type: derived

What it detects

This rule flags process executions of common Linux networking and firewall utilities used to enumerate local network configuration and routing. Attackers often run these commands to identify available interfaces, DNS settings, and connectivity paths before further discovery or exploitation. It relies on Linux process creation telemetry matching specific executable name endings and a command line string referencing /etc/resolv.conf.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.