Sigma informational stable sigma

System and Hardware Information Discovery

Detects system information discovery commands

View Source

Detection Logic

{
  "selection": {
    "type": "PATH",
    "name": [
      "/sys/class/dmi/id/bios_version",
      "/sys/class/dmi/id/product_name",
      "/sys/class/dmi/id/chassis_vendor",
      "/proc/scsi/scsi",
      "/proc/ide/hd0/model",
      "/proc/version",
      "/etc/*version",
      "/etc/*release",
      "/etc/issue"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...