Detectioninformationalstable

System and Hardware Information Discovery

Detects system information discovery commands

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Ömer Günal, oscd.communityCreated Thu Oct 08Updated Sat Nov 261f358e2e-cb63-43c3-b575-dfb072a6814flinux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Detection Logic

detection:
    selection:
        type: 'PATH'
        name:
            - '/sys/class/dmi/id/bios_version'
            - '/sys/class/dmi/id/product_name'
            - '/sys/class/dmi/id/chassis_vendor'
            - '/proc/scsi/scsi'
            - '/proc/ide/hd0/model'
            - '/proc/version'
            - '/etc/*version'
            - '/etc/*release'
            - '/etc/issue'
    condition: selection