Possible Linux Remote System Enumeration (via process_creation)

title: Possible Linux Remote System Enumeration (via process_creation)
id: 65d3af25-e212-5b14-b68e-7aa998ab12c4
status: stable
description: This rule detects the enumeration of other remote systems.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
author: Huntrule Team
date: 2026-04-01
tags:
    - attack.discovery
    - attack.t1018
logsource:
    category: process_creation
    product: linux
detection:
    selection_1:
        Image|endswith: '/arp'
        CommandLine|contains: '-a'
    selection_2:
        Image|endswith: '/ping'
        CommandLine|contains:
            - ' 10.'
            - ' 192.168.'
            - ' 172.16.'
            - ' 172.17.'
            - ' 172.18.'
            - ' 172.19.'
            - ' 172.20.'
            - ' 172.21.'
            - ' 172.22.'
            - ' 172.23.'
            - ' 172.24.'
            - ' 172.25.'
            - ' 172.26.'
            - ' 172.27.'
            - ' 172.28.'
            - ' 172.29.'
            - ' 172.30.'
            - ' 172.31.'
            - ' 127.'
            - ' 169.254.'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: low