OS Architecture Discovery Via Grep
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
Sigma
