CmdID

CmdID / Commands

ls

List files toybox

On Linux 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

List files sort by: (also --sort=longname,longname... ends with alphabetical) Long output uses -cu for display, use -ltc/-ltu to also sort by ctime/atime.

ls [-1ACFHLNRSUXZabcdfghilmnopqrstuwx] [--color[=auto]] [FILE...]
Show 39 options
-Aall files except . and ..
-aall files including .hidden
-bescape nongraphic chars
-ddirectory, not contents
-Fappend /dir *exe @sym |FIFO
-ffiles (no sort/filter/format)
-Hfollow command line symlinks
-iinode number
-Lfollow symlinks
-Nno escaping, even on tty
-pput '/' after dir names
-qunprintable chars as '?'
-Rrecursively list in subdirs
-sstorage used (units of --block-size)
-Zsecurity context
-1list one file per line
-Ccolumns (sorted vertically)
-glike -l but no owner
-hhuman readable sizes
-kreset --block-size to default
-llong (show full details)
-mcomma separated
-lllong with nanoseconds (--full-time)
-nlong with numeric uid/gid
-olong without group column
-rreverse order
-wset column width
-xcolumns (horizontal sort)
-cctime
-rreverse
-Ssize
-ttime
-uatime
-Unone
-Xextension
-!dirfirst
-~nocase
--block-size Nblock size for -s (default 1024, -k resets to 1024)
--color=always (default) =auto (when stdout is tty) =never exe=green suid=red suidfile=redback stickydir=greenback device=yellow symlink=turquoise/red dir=blue socket=purple

Several platforms

from tldr-pages, CC BY 4.0

List directory contents.

List files one per line

List all files, including hidden files

ls --allIdentify

List files with a trailing symbol to indicate file type (directory/, symbolic_link@, executable*, ...)

ls --classifyIdentify

List all files in long format (permissions, ownership, size, and modification date)

ls -l --allIdentify
-llong (show full details) toybox

List files in long format with size displayed using human-readable units (KiB, MiB, GiB)

ls -l --human-readableIdentify
-llong (show full details) toybox

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

List files in long format, sorted by Size (descending) recursively

ls -lS --recursiveIdentify
-llong (show full details) toybox
-Ssize toybox

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

List files in long format, sorted by time the file was modified and in reverse order (oldest first)

ls -lt --reverseIdentify
-llong (show full details) toybox
-ttime toybox

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Only list directories

ls --directory */Identify

What detects it

Sigma process creation rules that name ls
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community
informationalFile and Directory Discovery - LinuxDaniil Yugoslavskiy, oscd.community, CheraghiMilad
informationalFile and Directory Discovery - MacOSDaniil Yugoslavskiy, oscd.community