CmdID

CmdID / Commands

ifconfig

Display or configure network interface. toybox

On Linux 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Display or configure network interface. With no arguments, display active interfaces. First argument is interface to operate on, one argument by itself displays that interface. Standard ACTIONs to perform on an INTERFACE: ADDR[/MASK] - set IPv4 address (1.2.3.4/5) and activate interface add|del ADDR[/LEN] - add/remove IPv6 address (1111::8888/128) up|down - activate or deactivate interface Advanced ACTIONs (default values usually suffice): default - remove IPv4 address netmask ADDR - set IPv4 netmask via 255.255.255.0 instead of /24 txqueuelen LEN - number of buffered packets before output blocks mtu LEN - size of outgoing packets (Maximum Transmission Unit) broadcast ADDR - Set broadcast address pointopoint ADDR - PPP and PPPOE use this instead of "route add default gw" hw TYPE ADDR - set hardware (mac) address (type = ether|infiniband) rename NEWNAME - rename interface Flags you can set on an interface (or -remove by prefixing with -): arp - don't use Address Resolution Protocol to map LAN routes promisc - don't discard packets that aren't to this LAN hardware address multicast - force interface into multicast mode if the driver doesn't allmulti - promisc for multicast packets

ifconfig [-aS] [INTERFACE [ACTION...]]
-aAll interfaces displayed, not just active ones
-SShort view, one line per interface

Several platforms

from tldr-pages, CC BY 4.0

Network Interface Configurator.

View network settings of an interface

ifconfig interface_nameIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Display details of all interfaces, including disabled interfaces

ifconfig -aIdentify
-aAll interfaces displayed, not just active ones toybox

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Disable an interface

ifconfig interface_name downIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Enable an interface

ifconfig interface_name upIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Assign an IP address to an interface

ifconfig interface_name ip_addressIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

What detects it

Sigma process creation rules that name ifconfig
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
informationalSystem Network Discovery - LinuxÖmer Günal and remotephone, oscd.community
informationalSystem Network Discovery - macOSremotephone, oscd.community