System Network Discovery - Linux

A Sigma rule for process creation on Linux, by Ömer Günal and remotephone, oscd.community.

informational 1 ATT&CK technique 9 programs it names 170 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_cli:
    CommandLine|contains: '/etc/resolv.conf'
  selection_img:
    Image|endswith:
      - '/firewall-cmd'
      - '/ufw'
      - '/iptables'
      - '/netstat'
      - '/ss'
      - '/ip'
      - '/ifconfig'
      - '/systemd-resolve'
      - '/route'
  condition: 1 of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Ömer Günal and remotephone, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

List interfaces with detailed info on the page for ip

ip [aIdentify

List interfaces with brief network layer info on the page for ip

ip -brief [aIdentify

List interfaces with brief link layer info on the page for ip

ip -brief [lIdentify

Show all TCP/UDP/RAW/UNIX sockets on the page for ss

ss --all --tcpIdentify

Filter TCP sockets by states, only/exclude on the page for ss

ss state bucketIdentify

Show all TCP sockets connected to the local HTTPS port (443) on the page for ss

ss --tcp src :443Identify

View all available firewall zones and rules in their runtime configuration state on the page for firewall-cmd

firewall-cmd --list-all-zonesIdentify

Permanently move the interface into the block zone, effectively blocking all communication on the page for firewall-cmd

firewall-cmd --permanent --zone block --change-interface enp1s0Identify

Permanently open the port for a service in the specified zone (like port 443 when in the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --add-service httpsIdentify

Permanently close the port for a service in the specified zone (like port 80 when in the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --remove-service httpIdentify

Permanently forward a port for incoming packets in the specified zone (like port 443 to 8443 when entering the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --add-rich-rule 'rule family "ipv4" forward-port port "443" protocol "udp" to-port "8443"'

Identify

Reload firewalld to lose any runtime changes and force the permanent configuration to take effect immediately on the page for firewall-cmd

firewall-cmd --reloadIdentify

And 158 more examples on CmdID’s program pages.

The commands documented for ip, ss, systemd-resolve trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

ipsssystemd-resolvefirewall-cmdifconfigiptablesnetstatrouteufw

ATT&CK

the techniques it is tagged with

T1016System Network Configuration Discovery

System Network Discovery - Linux

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1016 System Network Configuration Discovery