IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Access via Direct System Call »

› › ›

Suspicious Proc Pseudo File System Enumeration

edit

Suspicious Proc Pseudo File System Enumeration

edit

This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.

Rule type: threshold

Rule indices:

auditbeat-*
logs-auditd_manager.auditd-*

Severity: low

Risk score: 21

Runs every: 60m

Searches indices from: now-119m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

OS: Linux
Use Case: Threat Detection
Tactic: Discovery
Rule Type: BBR

Version: 5

Rule authors:

Elastic

Rule license: Elastic License v2

Rule query

edit

host.os.type:linux and event.category:file and event.action:"opened-file" and
file.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : (
  ps or netstat or landscape-sysin or w or pgrep or pidof or needrestart or apparmor_status
) and not process.parent.pid : 1

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: Process Discovery
- ID: T1057
- Reference URL: https://attack.mitre.org/techniques/T1057/
Technique:
- Name: System Information Discovery
- ID: T1082
- Reference URL: https://attack.mitre.org/techniques/T1082/

« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Access via Direct System Call »