CmdID

CmdID / Commands

route

Show and manipulate the route table. tldr-pages

On macOS 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Display the information of route table

route -nIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Add route rule

sudo route add -net ip_address netmask netmask_address gw gw_addressIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Delete route rule

sudo route del -net ip_address netmask netmask_address dev gw_addressIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

macOS

from tldr-pages, CC BY 4.0

Manually manipulate the routing tables.

Add a route to a destination through a gateway

sudo route add "destination_ip_address" "gateway_address"Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Add a route to a /24 subnet through a gateway

sudo route add "subnet_ip_address/24" "gateway_address"Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Run in test mode (does not do anything, just print)

sudo route -t add "destination_ip_address/24" "gateway_address"Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Remove all routes

sudo route flushIdentify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Delete a specific route

sudo route delete "destination_ip_address/24"Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

Look up and display the route for a destination (hostname or IP address)

sudo route get "destination"Identify

Trips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community

What detects it

Sigma process creation rules that name route
highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
informationalSystem Network Discovery - LinuxÖmer Günal and remotephone, oscd.community