Potential Container Discovery Via Inodes Listing — Sigma Rule

Rule metadata and linked tags

Author: Seth Hanford. Source status: test; severity: low. Source dates: 2023-08-23 / 2025-11-24.

{
  "category": "process_creation",
  "product": "linux"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: c92b7b7ad8ed9c4c2d632195ed70edd6ff05c33dae5a8c29e6b1f190911e0cf0

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Container Discovery Via Inodes Listing
id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8
status: test
description: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
references:
    - https://blog.skyplabs.net/posts/container-detection/
    - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
tags:
    - attack.discovery
    - attack.t1082
author: Seth Hanford
date: 2023-08-23
modified: 2025-11-24
logsource:
    category: process_creation
    product: linux
detection:
    selection_ls_img:
        Image|endswith: '/ls'    # inode outside containers low, inside high
    selection_ls_cli:
        - CommandLine|endswith: ' /'
        - CommandLine|contains: ' / '
    selection_regex_inode:
        CommandLine|re: '(?:\s-[^-\s]{0,20}i|\s--inode\s)'      # -i finds inode number
    selection_regex_dir:
        CommandLine|re: '(?:\s-[^-\s]{0,20}d|\s--directory\s)'  # -d gets directory itself, not contents
    condition: all of selection_*
falsepositives:
    - Legitimate system administrator usage of these commands
    - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
level: low

Original YAML and metadata in JSON

False positives

• Legitimate system administrator usage of these commands
• Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered

Source references

• https://blog.skyplabs.net/posts/container-detection/
• https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker