{"id":"746c86fb-ccda-4816-8997-01386263acc4","title":"Container Residence Discovery Via Proc Virtual FS","description":"Detects potential container discovery via listing of certain kernel features in the \"/proc\" virtual filesystem","author":"Seth Hanford","status":"test","level":"low","date":"2023-08-23","modified":"","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate system administrator usage of these commands","Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered"],"references":["https://blog.skyplabs.net/posts/container-detection/","https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml","source_sha256":"9bc91159b4b8822216b996186341a165b1c93b22373df22f7b9c384edfd942cd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Container Residence Discovery Via Proc Virtual FS\nid: 746c86fb-ccda-4816-8997-01386263acc4\nstatus: test\ndescription: Detects potential container discovery via listing of certain kernel features in the \"/proc\" virtual filesystem\nreferences:\n    - https://blog.skyplabs.net/posts/container-detection/\n    - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n    - attack.discovery\n    - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_tools:\n        Image|endswith:\n            - 'awk'\n            - '/cat'\n            - 'grep'\n            - '/head'\n            - '/less'\n            - '/more'\n            - '/nl'\n            - '/tail'\n    selection_procfs_kthreadd:  # outside containers, PID 2 == kthreadd\n        CommandLine|contains: '/proc/2/'\n    selection_procfs_target:\n        CommandLine|contains: '/proc/'\n        CommandLine|endswith:\n            - '/cgroup'  # cgroups end in ':/' outside containers\n            - '/sched'   # PID mismatch when run in containers\n    condition: selection_tools and 1 of selection_procfs_*\nfalsepositives:\n    - Legitimate system administrator usage of these commands\n    - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/746c86fb-ccda-4816-8997-01386263acc4.json","kind":"sigma"}