MITRE ATT&CK technique
Gather Victim Host Information detection rulesT1592
Gather Victim Host Information (T1592) is a MITRE ATT&CK technique in the Reconnaissance tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1592 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target linux.
Top products
Tactic
Linux Recon Indicators
highDetects events with patterns found in commands used for reconnaissance on linux systems
linux · process_creation
Access of Sudoers File Content
mediumDetects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
linux · process_creation
Print History File Contents
mediumDetects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
linux · process_creation