Sigma informational stable sigma

System Information Discovery

Detects system information discovery commands

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": [
      "/uname",
      "/hostname",
      "/uptime",
      "/lspci",
      "/dmidecode",
      "/lscpu",
      "/lsmod"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...