System Information Discovery - Auditd

Status: test
Severity: low
Log source: product linux, service auditd
Author: Pawel Mazur
Source: github.com/SigmaHQ/sigma

Detects System Information Discovery commands

Known false positives

Likely

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery

Telemetry coverage

Platform	Record / event type
Linux	auditd PATH record: Filename path information
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule body

title: System Information Discovery - Auditd
id: f34047d9-20d3-4e8b-8672-0a35cc50dc71
status: test
description: Detects System Information Discovery commands
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md
author: Pawel Mazur
date: 2021-09-03
modified: 2023-03-06
tags:
    - attack.discovery
    - attack.t1082
logsource:
    product: linux
    service: auditd
detection:
    selection_1:
        type: PATH
        name:
            - /etc/lsb-release
            - /etc/redhat-release
            - /etc/issue
    selection_2:
        type: EXECVE
        a0:
            - uname
            - uptime
            - lsmod
            - hostname
            - env
    selection_3:
        type: EXECVE
        a0: grep
        a1|contains:
            - vbox
            - vm
            - xen
            - virtio
            - hv
    selection_4:
        type: EXECVE
        a0: kmod
        a1: list
    condition: 1 of selection_*
falsepositives:
    - Likely
level: low

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_1`

selection_1:
    type: PATH
    name:
        - /etc/lsb-release
        - /etc/redhat-release
        - /etc/issue

Stage 2: `selection_2`

selection_2:
    type: EXECVE
    a0:
        - uname
        - uptime
        - lsmod
        - hostname
        - env

Stage 3: `selection_3`

selection_3:
    type: EXECVE
    a0: grep
    a1|contains:
        - vbox
        - vm
        - xen
        - virtio
        - hv

Stage 4: `selection_4`

selection_4:
    type: EXECVE
    a0: kmod
    a1: list

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`a0`	eq	`env` `grep` `hostname` `kmod` `lsmod` `uname` `uptime`	`field:"a0" kind:eq`
`a1`	eq	`list`	`field:"a1" kind:eq value:"list"`
`a1`	match	`hv` `vbox` `virtio` `vm` `xen`	`field:"a1" kind:match`
`name`	eq	`/etc/issue` `/etc/lsb-release` `/etc/redhat-release`	`field:"name" kind:eq`
`type`	eq	`EXECVE` `PATH`	`field:"type" kind:eq`

System Information Discovery - Auditd

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_1

Stage 2: selection_2

Stage 3: selection_3

Stage 4: selection_4

Indicators

Stage 0: `condition`

Stage 1: `selection_1`

Stage 2: `selection_2`

Stage 3: `selection_3`

Stage 4: `selection_4`