Sigma informational test sigma

File and Directory Discovery - Linux

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

View Source

Detection Logic

{
  "selection_file_with_asterisk": {
    "Image
| endswith": "/file",
    "CommandLine
| re": "(.){200,}"
  },
  "selection_recursive_ls": {
    "Image
| endswith": "/ls",
    "CommandLine
| contains": "-R"
  },
  "selection_find_execution": {
    "Image
| endswith": "/find"
  },
  "selection_tree_execution": {
    "Image
| endswith": "/tree"
  },
  "selection_findmnt_execution": {
    "Image
| endswith": "/findmnt"
  },
  "selection_locate_execution": {
    "Image
| endswith": "/mlocate"
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Legitimate activities

Field Validations

Loading…

Comments (0)

Loading comments...