Detectionlowtest
System Network Connections Discovery - Linux
Detects usage of system utilities to discover system network connections
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Daniil Yugoslavskiy, oscd.communityCreated Mon Oct 19Updated Tue Jan 174c519226-f0cd-4471-bd2f-6fbb2bb68a79linux
Log Source
LinuxProcess Creation
ProductLinux← raw: linux
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
Image|endswith:
- '/who'
- '/w'
- '/last'
- '/lsof'
- '/netstat'
filter_landscape_sysinfo:
ParentCommandLine|contains: '/usr/bin/landscape-sysinfo'
Image|endswith: '/who'
condition: selection and not 1 of filter_*False Positives
Legitimate activities
References
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
4c519226-f0cd-4471-bd2f-6fbb2bb68a79
Status
test
Level
low
Type
Detection
Created
Mon Oct 19
Modified
Tue Jan 17
Path
rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml
Raw Tags
attack.discoveryattack.t1049