{"id":"11701de9-d5a5-44aa-8238-84252f131895","title":"Docker Container Discovery Via Dockerenv Listing","description":"Detects listing or file reading of \".dockerenv\" which can be a sing of potential container discovery","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":"","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate system administrator usage of these commands","Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered"],"references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml","source_sha256":"47eda2228690e3d31ee08fc3202031bf61c7573405c91f606ffe094f3fe56d7d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Docker Container Discovery Via Dockerenv Listing\nid: 11701de9-d5a5-44aa-8238-84252f131895\nstatus: test\ndescription: Detects listing or file reading of \".dockerenv\" which can be a sing of potential container discovery\nreferences:\n    - https://blog.skyplabs.net/posts/container-detection/\n    - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n    - attack.discovery\n    - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            # Note: add additional tools and utilities to increase coverage\n            - '/cat'\n            - '/dir'\n            - '/find'\n            - '/ls'\n            - '/stat'\n            - '/test'\n            - 'grep'\n        CommandLine|endswith: '.dockerenv'\n    condition: selection\nfalsepositives:\n    - Legitimate system administrator usage of these commands\n    - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/11701de9-d5a5-44aa-8238-84252f131895.json","kind":"sigma"}