System Information Discovery
A Sigma rule for process creation on Linux, by Ömer Günal, oscd.community.
informational 1 ATT&CK technique 7 programs it names 37 everyday examples trip it
What it looks for
detection:
selection:
Image|endswith:
- '/uname'
- '/hostname'
- '/uptime'
- '/lspci'
- '/dmidecode'
- '/lscpu'
- '/lsmod'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Ömer Günal, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Show the system's serial number on the page for dmidecode
sudo dmidecode --string system-serial-numberIdentifyDisplay only information about online CPUs in a table on the page for lscpu
lscpu --extended --onlineIdentifyDisplay only information about offline CPUs in a table on the page for lscpu
lscpu --extended --offlineIdentifyAnd 25 more examples on CmdID’s program pages.
The commands LOLBAS or GTFOBins documents for dmidecode trip it too: each is on its program’s page, read by CmdID.