File and Directory Discovery - Linux

A Sigma rule for process creation on Linux, by Daniil Yugoslavskiy, oscd.community, CheraghiMilad.

informational 1 ATT&CK technique 5 programs it names 37 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_file_with_asterisk:
    CommandLine|re: '(.){200,}'
    Image|endswith: '/file'
  selection_find_execution:
    Image|endswith: '/find'
  selection_findmnt_execution:
    Image|endswith: '/findmnt'
  selection_locate_execution:
    Image|endswith: '/mlocate'
  selection_recursive_ls:
    CommandLine|contains: '-R'
    Image|endswith: '/ls'
  selection_tree_execution:
    Image|endswith: '/tree'
  condition: 1 of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Daniil Yugoslavskiy, oscd.community, CheraghiMilad, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Copy all files and directories in a directory and add them onto an archive (copy-out), in verbose mode on the page for cpio

find path/to/directory | cpio [-ov|--create --verbose] >archive.cpioIdentify

Find files by extension on the page for find

find path/to/directory -name '*.ext'Identify

Find files matching multiple path/name patterns on the page for find

find path/to/directory -path '*/path/*/*.ext' -or -name '*pattern*'Identify

Find directories matching a given name, in case-insensitive mode on the page for find

find path/to/directory -type d -iname '*lib*'Identify

Start fzf on all files in the specified directory on the page for fzf

find path/to/directory -type f | fzfIdentify

Select multiple files with <Shift Tab> and write to a file on the page for fzf

find path/to/directory -type f | fzf --multi >path/to/fileIdentify

Test all PPD files under the current directory, printing the names of each file that does not conform on the page for cupstestppd

find . -name \*.ppd \! -execdir cupstestppd -q '{}' \; -printIdentify

Rebuild the project if source files change, limiting output to the first few lines on the page for entr

find src/ | entr -s 'make | sed 10q'Identify

List all mounted filesystems on the page for findmnt

findmntIdentify

Search for a device on the page for findmnt

findmnt /dev/sdb1Identify

Search for a mountpoint on the page for findmnt

findmnt /Identify

Find filesystems in specific type on the page for findmnt

findmnt --types ext4,virtiofs,btrfs,...Identify

And 25 more examples on CmdID’s program pages.

The commands LOLBAS or GTFOBins documents for find trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

filefindfindmntlstree

ATT&CK

the techniques it is tagged with

T1083File and Directory Discovery

File and Directory Discovery - Linux

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1083 File and Directory Discovery