OS Architecture Discovery Via Grep

Status: test
Severity: low
Log source: category process_creation, product linux
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: OS Architecture Discovery Via Grep
id: d27ab432-2199-483f-a297-03633c05bae6
status: test
description: |
    Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
references:
    - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
    - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
    - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
    - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-06-02
tags:
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: linux
detection:
    selection_process:
        Image|endswith: '/grep'
    selection_architecture:
        CommandLine|endswith:
            - 'aarch64'
            - 'arm'
            - 'i386'
            - 'i686'
            - 'mips'
            - 'x86_64'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_process`

selection_process:
    Image|endswith: '/grep'

Stage 2: `selection_architecture`

selection_architecture:
    CommandLine|endswith:
        - 'aarch64'
        - 'arm'
        - 'i386'
        - 'i686'
        - 'mips'
        - 'x86_64'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`aarch64` `arm` `i386` `i686` `mips` `x86_64`	`field:"CommandLine" kind:ends_with`
`Image`	ends_with	`/grep`	`field:"Image" kind:ends_with value:"/grep"`