Sigma rule: System Info Discovery via Sysinfo Syscall

Rule

Title

System Info Discovery via Sysinfo Syscall

Status

experimental

Level

low

Author

Milad Cheraghi

Date

2025-05-30

Modified

2025-12-05

File

rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

Log source

product

linux

service

auditd

definition

Required auditd configuration: -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall

Detection

selection:
    type: 'SYSCALL'
    SYSCALL: 'sysinfo'
filter_optional_splunk:
    exe|endswith: '/bin/splunkd'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate administrative activity

Tags

• attack.discovery
• attack.t1057
• attack.t1082

MITRE ATT&CK ids this rule names

• T1057
• T1082

References

• https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
• https://man7.org/linux/man-pages/man2/sysinfo.2.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml