CmdID

CmdID / Commands

lsof

List open files and the corresponding processes. tldr-pages

On several platforms 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

List open files and the corresponding processes. Note: Root privileges are required to list files opened by others.

Find the processes that have a given file open

lsof path/to/fileIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

Find the process that opened a local internet port

lsof -i :portIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

Only output the process ID (PID)

lsof -t path/to/fileIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

List files opened by the given user

lsof -u usernameIdentify

Trips 4 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

List files opened by the given command or process

lsof -c process_or_command_nameIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

List files opened by a specific process, given its PID

lsof -p process_idIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

List open files in a directory

lsof +D path/to/directoryIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

Find the process that is listening on a local IPv6 TCP port and don't convert network or port numbers

lsof -i6TCP:port -sTCP:LISTEN -n -PIdentify

Trips 2 Sigma rules: lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community

What detects it

Sigma process creation rules that name lsof
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community
lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad
lowSystem Network Connections Discovery - LinuxDaniil Yugoslavskiy, oscd.community
informationalSystem Network Connections Discovery - MacOsDaniil Yugoslavskiy, oscd.community