Possible OS Architecture Enumeration Through Grep (via process_creation)

title: Possible OS Architecture Enumeration Through Grep (via process_creation)
id: 804b322d-bbb2-5d97-9fe7-05f6f55e997e
status: stable
description: This rule detects the use of grep to identify information about the operating system architecture. Frequently combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
references:
    - https://attack.mitre.org/techniques/T1082/
    - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
    - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
    - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
    - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
author: Huntrule Team
date: 2026-04-19
tags:
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: linux
detection:
    selection_process:
        Image|endswith: '/grep'
    selection_architecture:
        CommandLine|endswith:
            - 'aarch64'
            - 'arm'
            - 'i386'
            - 'i686'
            - 'mips'
            - 'x86_64'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low