Possible Container Enumeration Through Inodes Listing (via process_creation)

title: Possible Container Enumeration Through Inodes Listing (via process_creation)
id: f9d6dd36-fdbb-5f1f-b8fc-9cd4dc4cf5fc
status: stable
description: This rule detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
references:
    - https://attack.mitre.org/techniques/T1082/
    - https://blog.skyplabs.net/posts/container-detection/
    - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
tags:
    - attack.discovery
    - attack.t1082
author: Huntrule Team
date: 2026-06-15
logsource:
    category: process_creation
    product: linux
detection:
    selection_ls_img:
        Image|endswith: '/ls'
    selection_ls_cli:
        - CommandLine|endswith: ' /'
        - CommandLine|contains: ' / '
    selection_regex_inode:
        CommandLine|re: '(?:\s-[^-\s]{0,20}i|\s--inode\s)'
    selection_regex_dir:
        CommandLine|re: '(?:\s-[^-\s]{0,20}d|\s--directory\s)'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low