huntrule

Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

FreeReviewedSigma · Informational · v2
Product
linux
Category
process_creation
Author
Ömer Günal and remotephone, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-06
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions on Linux where the command path ends with common network enumeration utilities (e.g., firewall-cmd, ufw, iptables, netstat, ss, ip, ifconfig, systemd-resolve, route), or where the command line contains /etc/resolv.conf. Attackers and administrators use these commands to discover local network configuration, routing, and name resolution details that can inform further targeting. The detection relies on process creation telemetry including the executable image path and command-line content.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)
Suspicious External IP Discovery via curl to ifconfig.me via process_creation
Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)
Linux System Network Discovery via Firewall/Network Tools
Pivot detection · T1016 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.