Linux Network Service Scanning Tools Execution
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Sigma
