Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

FreeReviewedSigma · Informational · v2

Product: linux
Category: process_creation
Author: Ömer Günal and remotephone, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions on Linux where the command path ends with common network enumeration utilities (e.g., firewall-cmd, ufw, iptables, netstat, ss, ip, ifconfig, systemd-resolve, route), or where the command line contains /etc/resolv.conf. Attackers and administrators use these commands to discover local network configuration, routing, and name resolution details that can inform further targeting. The detection relies on process creation telemetry including the executable image path and command-line content.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

Linux System Network Discovery via Firewall/Network Tools

Pivot detection · T1016 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-system-network-discovery-via-firewall-netstat-route-and-interface-commands-e7bd1cfa

title: Linux System Network Discovery via Firewall/Network Tools
id: 2ae66ec9-b25f-4703-bdc1-4b9db1d517c9
status: test
description: This rule flags process executions on Linux where the command path ends with common network enumeration utilities (e.g., firewall-cmd, ufw, iptables, netstat, ss, ip, ifconfig, systemd-resolve, route), or where the command line contains /etc/resolv.conf. Attackers and administrators use these commands to discover local network configuration, routing, and name resolution details that can inform further targeting. The detection relies on process creation telemetry including the executable image path and command-line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml
author: Ömer Günal and remotephone, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-09-15
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /firewall-cmd
      - /ufw
      - /iptables
      - /netstat
      - /ss
      - /ip
      - /ifconfig
      - /systemd-resolve
      - /route
  selection_cli:
    CommandLine|contains: /etc/resolv.conf
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL