CmdID

CmdID / Rules / Linux

System Network Connections Discovery - Linux

A Sigma rule for process creation on Linux, by Daniil Yugoslavskiy, oscd.community.

low 1 ATT&CK technique 4 programs it names 37 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    Image|endswith:
      - '/lsof'
      - '/netstat'
      - '/sockstat'
      - '/ss'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Daniil Yugoslavskiy, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Show all TCP/UDP/RAW/UNIX sockets on the page for ss

ss --all --tcpIdentify

Filter TCP sockets by states, only/exclude on the page for ss

ss state bucketIdentify

Show all TCP sockets connected to the local HTTPS port (443) on the page for ss

ss --tcp src :443Identify

Find the processes that have a given file open on the page for lsof

lsof path/to/fileIdentify

Find the process that opened a local internet port on the page for lsof

lsof -i :portIdentify

Only output the process ID (PID) on the page for lsof

lsof -t path/to/fileIdentify

List files opened by the given user on the page for lsof

lsof -u usernameIdentify

List files opened by the given command or process on the page for lsof

lsof -c process_or_command_nameIdentify

List files opened by a specific process, given its PID on the page for lsof

lsof -p process_idIdentify

List open files in a directory on the page for lsof

lsof +D path/to/directoryIdentify

Find the process that is listening on a local IPv6 TCP port and don't convert network or port numbers on the page for lsof

lsof -i6TCP:port -sTCP:LISTEN -n -PIdentify

List all ports on the page for netstat

netstat --allIdentify

And 25 more examples on CmdID’s program pages.

The commands LOLBAS or GTFOBins documents for ss trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here
sslsofnetstatsockstat

ATT&CK

the techniques it is tagged with
T1049System Network Connections Discovery

Other rules for T1049 System Network Connections Discovery

System Network Connections Discovery - MacOs · System Network Connections Discovery Via Net.EXE