{"id":"43e26eb5-cd58-48d1-8ce9-a273f5d298d8","title":"Potential Container Discovery Via Inodes Listing","description":"Detects listing of the inodes of the \"/\" directory to determine if the we are running inside of a container.","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":"2025-11-24","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate system administrator usage of these commands","Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered"],"references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml","source_sha256":"c92b7b7ad8ed9c4c2d632195ed70edd6ff05c33dae5a8c29e6b1f190911e0cf0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Container Discovery Via Inodes Listing\nid: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8\nstatus: test\ndescription: Detects listing of the inodes of the \"/\" directory to determine if the we are running inside of a container.\nreferences:\n    - https://blog.skyplabs.net/posts/container-detection/\n    - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n    - attack.discovery\n    - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nmodified: 2025-11-24\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_ls_img:\n        Image|endswith: '/ls'    # inode outside containers low, inside high\n    selection_ls_cli:\n        - CommandLine|endswith: ' /'\n        - CommandLine|contains: ' / '\n    selection_regex_inode:\n        CommandLine|re: '(?:\\s-[^-\\s]{0,20}i|\\s--inode\\s)'      # -i finds inode number\n    selection_regex_dir:\n        CommandLine|re: '(?:\\s-[^-\\s]{0,20}d|\\s--directory\\s)'  # -d gets directory itself, not contents\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate system administrator usage of these commands\n    - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/43e26eb5-cd58-48d1-8ce9-a273f5d298d8.json","kind":"sigma"}