IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Access via Direct System Call »
Elastic Docs ›Elastic Security Solution [8.8] ›Detections and alerts ›Prebuilt rule reference

Suspicious Proc Pseudo File System Enumeration

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Suspicious Proc Pseudo File System Enumeration

edit

This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.

Rule type: threshold

Rule indices:

  • auditbeat-*
  • logs-auditd_manager.auditd-*

Severity: low

Risk score: 21

Runs every: 60m

Searches indices from: now-119m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Rule Type: BBR

Version: 5

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
host.os.type:linux and event.category:file and event.action:"opened-file" and
file.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : (
  ps or netstat or landscape-sysin or w or pgrep or pidof or needrestart or apparmor_status
) and not process.parent.pid : 1

Framework: MITRE ATT&CKTM

« Suspicious PrintSpooler Service Executable File Creation Suspicious Process Access via Direct System Call »