Sigma low test sigma

Container Residence Discovery Via Proc Virtual FS

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

View Source

Detection Logic

{
  "selection_tools": {
    "Image
| endswith": [
      "awk",
      "/cat",
      "grep",
      "/head",
      "/less",
      "/more",
      "/nl",
      "/tail"
    ]
  },
  "selection_procfs_kthreadd": {
    "CommandLine
| contains": "/proc/2/"
  },
  "selection_procfs_target": {
    "CommandLine
| contains": "/proc/",
    "CommandLine
| endswith": [
      "/cgroup",
      "/sched"
    ]
  },
  "condition": "selection_tools and 1 of selection_procfs_*"
}

False Positives

  • ⚠ Legitimate system administrator usage of these commands
  • ⚠ Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered

Field Validations

Loading…

Comments (0)

Loading comments...