Sigma rule: Linux Network Service Scanning Tools Execution

Rule

Title

Linux Network Service Scanning Tools Execution

Status

test

Level

low

Author

Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Date

2020-10-21

Modified

2024-09-19

File

rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

Log source

product

linux

category

process_creation

Detection

selection_netcat:
    Image|endswith:
        - '/nc'
        - '/ncat'
        - '/netcat'
        - '/socat'
selection_network_scanning_tools:
    Image|endswith:
        - '/autorecon'
        - '/hping'
        - '/hping2'
        - '/hping3'
        - '/naabu'
        - '/nmap'
        - '/nping'
        - '/telnet' # could be wget, curl, ssh, many things. basically everything that is able to do network connection. consider fine tuning
        - '/zenmap'
filter_main_netcat_listen_flag:
    CommandLine|contains:
        - ' --listen '
        - ' -l '
condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.discovery
• attack.t1046

MITRE ATT&CK ids this rule names

• T1046

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
• https://github.com/projectdiscovery/naabu
• https://github.com/Tib3rius/AutoRecon

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml