Linux Network Service Scanning Tools Execution

A Sigma rule for process creation on Linux, by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]).

low 1 ATT&CK technique 11 programs it names 36 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  filter_main_netcat_listen_flag:
    CommandLine|contains:
      - ' --listen '
      - ' -l '
  selection_netcat:
    Image|endswith:
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
  selection_network_scanning_tools:
    Image|endswith:
      - '/autorecon'
      - '/hping'
      - '/hping2'
      - '/hping3'
      - '/naabu'
      - '/nmap'
      - '/nping'
      - '/telnet'
      - '/zenmap'
  condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Ping a destination with 4 ICMP ping requests on the page for hping3

hping3 --icmp --count 4 ip_or_hostnameIdentify

Ping an IP address over UDP on port 80 on the page for hping3

hping3 --udp --destport 80 --syn ip_or_hostnameIdentify

Scan TCP port 80, scanning from the specific local source port 5090 on the page for hping3

hping3 --verbose --syn --destport 80 --baseport 5090 ip_or_hostnameIdentify

Connect to a target listener on the specified port and receive a file from it on the page for nc

nc host port >received_filenameIdentify

Scan the open TCP ports of a specified host on the page for nc

nc -v -z -w timeout_in_seconds host start_port-end_portIdentify

Scan the top 1000 ports of a remote host with various verbosity levels on the page for nmap

nmap -v1 ip_or_hostnameIdentify

Run a ping sweep over an entire subnet or individual hosts very aggressively on the page for nmap

nmap -T5 -sn 192.168.0.0/24Identify

Enable OS detection, version detection, script scanning, and traceroute of hosts from a file on the page for nmap

sudo nmap -A -iL path/to/file.txtIdentify

Listen to a port, wait for an incoming connection, and transfer data to STDIO on the page for socat

sudo socat - TCP-LISTEN:8080,forkIdentify

Listen on a port using SSL and print to stdout on the page for socat

sudo socat OPENSSL-LISTEN:4433,reuseaddr,cert=./cert.pem,cafile=./ca.cert.pem,key=./key.pem,verify=0 STDOUTIdentify

Create a connection to a host and port, transfer data in STDIO to connected host on the page for socat

sudo socat - TCP4:www.example.com:80Identify

Telnet to the default port of a host on the page for telnet

telnet hostIdentify

And 24 more examples on CmdID’s program pages.

The commands documented for busybox, hping3, nc, nmap, socat, telnet trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

hping3ncnmapsocattelnetautoreconhpingnaabuncatnetcatnping

ATT&CK

the techniques it is tagged with

T1046Network Service Discovery

Linux Network Service Scanning Tools Execution

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1046 Network Service Discovery