CmdID

CmdID / Commands

lspci

List PCI devices. toybox

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
lspci [-ekmn] [-i FILE]
-eExtended (6 digit) class
-i FILEID database (default /etc/pci.ids[.gz])
-kShow kernel driver
-mMachine readable
-nNumeric output (-nn for both)
-DPrint domain numbers
-xHex dump of config space (64 bytes; -xxx for 256, -xxxx for 4096)

Linux

from tldr-pages, CC BY 4.0

List all PCI devices.

Show a brief list of devices

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Display verbose information (Note: the -v flag can be repeated to increase verbosity)

lspci -vIdentify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Display kernel drivers and modules handling each device

lspci -kIdentify
-kShow kernel driver toybox

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

select a specific device

lspci -s 00:18.3Identify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Dump info in a (machine) readable form

lspci -vmIdentify
-mMachine readable toybox

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Show PCI vendor and device codes as both numbers and names

lspci -nnIdentify
-nNumeric output (-nn for both) toybox
-nNumeric output (-nn for both) toybox

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

What detects it

Sigma process creation rules that name lspci
informationalSystem Information DiscoveryÖmer Günal, oscd.community