{"id":"3761e026-f259-44e6-8826-719ed8079408","title":"Linux Network Service Scanning - Auditd","description":"Detects enumeration of local or remote network services.","author":"Alejandro Ortuno, oscd.community","status":"test","level":"low","date":"2020-10-21","modified":"2023-09-26","tags":["attack.discovery","attack.t1046"],"technique_ids":["T1046"],"logsource":{"product":"linux","service":"auditd","definition":"Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md"],"source_path":"rules/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml","source_sha256":"1cf8f8bdf14232c618b499415187043afb24c35202a2f5017fa4e4cb1b90a942","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Network Service Scanning - Auditd\nid: 3761e026-f259-44e6-8826-719ed8079408\nrelated:\n    - id: 3e102cd9-a70d-4a7a-9508-403963092f31\n      type: derived\nstatus: test\ndescription: Detects enumeration of local or remote network services.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-21\nmodified: 2023-09-26\ntags:\n    - attack.discovery\n    - attack.t1046\nlogsource:\n    product: linux\n    service: auditd\n    definition: 'Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183'\ndetection:\n    selection:\n        type: 'SYSCALL'\n        exe|endswith:\n            - '/telnet'\n            - '/nmap'\n            - '/netcat'\n            - '/nc'\n            - '/ncat'\n            - '/nc.openbsd'\n        key: 'network_connect_4'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","page":"techniques/enterprise/T1046/"}],"data_path":"data/detection-rules/3761e026-f259-44e6-8826-719ed8079408.json","kind":"sigma"}