Linux System Network Connections and User Discovery

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the execution of common Linux utilities used to discover system network connections and logged-in users. Specifically, it looks for 'who', 'w', 'last', 'lsof', and 'netstat' commands. It filters out legitimate calls from '/usr/bin/landscape-sysinfo' when 'who' is used.