{"id":"11063ec2-de63-4153-935e-b1a8b9e616f1","title":"Linux Remote System Discovery","description":"Detects the enumeration of other remote systems.","author":"Alejandro Ortuno, oscd.community","status":"test","level":"low","date":"2020-10-22","modified":"2021-11-27","tags":["attack.discovery","attack.t1018"],"technique_ids":["T1018"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"source_path":"rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml","source_sha256":"8b48e90fd66ff59fe12af188cdd7c23c607352bfa805fc2f973ad6b70d2696b5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Remote System Discovery\nid: 11063ec2-de63-4153-935e-b1a8b9e616f1\nstatus: test\ndescription: Detects the enumeration of other remote systems.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-22\nmodified: 2021-11-27\ntags:\n    - attack.discovery\n    - attack.t1018\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_1:\n        Image|endswith: '/arp'\n        CommandLine|contains: '-a'\n    selection_2:\n        Image|endswith: '/ping'\n        CommandLine|contains:\n            - ' 10.' # 10.0.0.0/8\n            - ' 192.168.' # 192.168.0.0/16\n            - ' 172.16.' # 172.16.0.0/12\n            - ' 172.17.'\n            - ' 172.18.'\n            - ' 172.19.'\n            - ' 172.20.'\n            - ' 172.21.'\n            - ' 172.22.'\n            - ' 172.23.'\n            - ' 172.24.'\n            - ' 172.25.'\n            - ' 172.26.'\n            - ' 172.27.'\n            - ' 172.28.'\n            - ' 172.29.'\n            - ' 172.30.'\n            - ' 172.31.'\n            - ' 127.' # 127.0.0.0/8\n            - ' 169.254.' # 169.254.0.0/16\n    condition: 1 of selection*\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"}],"data_path":"data/detection-rules/11063ec2-de63-4153-935e-b1a8b9e616f1.json","kind":"sigma"}