{"id":"b207d563-a1d9-4275-b349-77d1eb55aa6d","title":"System Info Discovery via Sysinfo Syscall","description":"Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.\nMalware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.\n","author":"Milad Cheraghi","status":"experimental","level":"low","date":"2025-05-30","modified":"2025-12-05","tags":["attack.discovery","attack.t1057","attack.t1082"],"technique_ids":["T1057","T1082"],"logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n-a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\n"},"falsepositives":["Legitimate administrative activity"],"references":["https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md","https://man7.org/linux/man-pages/man2/sysinfo.2.html"],"source_path":"rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","source_sha256":"db335a709533393176e73b109c70242a541381363c9e417e3aa5b27d4b3aa022","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Info Discovery via Sysinfo Syscall\nid: b207d563-a1d9-4275-b349-77d1eb55aa6d\nstatus: experimental\ndescription: |\n    Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.\n    Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.\nreferences:\n    - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md\n    - https://man7.org/linux/man-pages/man2/sysinfo.2.html\nauthor: Milad Cheraghi\ndate: 2025-05-30\nmodified: 2025-12-05\ntags:\n    - attack.discovery\n    - attack.t1057\n    - attack.t1082\nlogsource:\n    product: linux\n    service: auditd\n    definition: |\n        Required auditd configuration:\n        -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n        -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\ndetection:\n    selection:\n        type: 'SYSCALL'\n        SYSCALL: 'sysinfo'\n    filter_optional_splunk:\n        exe|endswith: '/bin/splunkd'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate administrative activity\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","page":"techniques/enterprise/T1057/"},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/b207d563-a1d9-4275-b349-77d1eb55aa6d.json","kind":"sigma"}