Process Discovery
A Sigma rule for process creation on Linux, from SigmaHQ’s threat hunting rules, by Ömer Günal, oscd.community, CheraaghiMilad.
low 1 ATT&CK technique 6 programs it names 46 everyday examples trip it
What it looks for
detection:
selection:
Image|endswith:
- '/atop'
- '/htop'
- '/pgrep'
- '/ps'
- '/pstree'
- '/top'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Ömer Günal, oscd.community, CheraaghiMilad, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Start and display thread-specific resource utilization information on the page for atop
atop -yIdentifyStart htop displaying processes owned by a specific user on the page for htop
htop --user usernameIdentifyAnd 34 more examples on CmdID’s program pages.
The commands LOLBAS or GTFOBins documents for top trip it too: each is on its program’s page, read by CmdID.