{"id":"f34047d9-20d3-4e8b-8672-0a35cc50dc71","title":"System Information Discovery - Auditd","description":"Detects System Information Discovery commands","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-03","modified":"2023-03-06","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Likely"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md"],"source_path":"rules/linux/auditd/lnx_auditd_system_info_discovery.yml","source_sha256":"cc31eeb6f65b1b52cd38f9852bb55d74004a823747c7ec1a48c2004bc7b26a2c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_system_info_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Information Discovery - Auditd\nid: f34047d9-20d3-4e8b-8672-0a35cc50dc71\nstatus: test\ndescription: Detects System Information Discovery commands\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md\nauthor: Pawel Mazur\ndate: 2021-09-03\nmodified: 2023-03-06\ntags:\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection_1:\n        type: PATH\n        name:\n            - /etc/lsb-release\n            - /etc/redhat-release\n            - /etc/issue\n    selection_2:\n        type: EXECVE\n        a0:\n            - uname\n            - uptime\n            - lsmod\n            - hostname\n            - env\n    selection_3:\n        type: EXECVE\n        a0: grep\n        a1|contains:\n            - vbox\n            - vm\n            - xen\n            - virtio\n            - hv\n    selection_4:\n        type: EXECVE\n        a0: kmod\n        a1: list\n    condition: 1 of selection_*\nfalsepositives:\n    - Likely\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/f34047d9-20d3-4e8b-8672-0a35cc50dc71.json","kind":"sigma"}