CmdID

CmdID / Commands

findmnt

Find your filesystem. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

List all mounted filesystems

findmntIdentify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Search for a device

findmnt /dev/sdb1Identify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Search for a mountpoint

findmnt /Identify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Find filesystems in specific type

findmnt --types ext4,virtiofs,btrfs,...Identify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Find filesystems with specific label

findmnt LABEL=BigStorageIdentify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Check mount table content in detail and verify /etc/fstab

findmnt --verify --verboseIdentify

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

What detects it

Sigma process creation rules that name findmnt
informationalFile and Directory Discovery - LinuxDaniil Yugoslavskiy, oscd.community, CheraghiMilad