PeopleSoft Mount and Hosts File Reconnaissance

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•3

Detects inspection of active mounts or /etc/hosts for PeopleSoft, configuration home, NFS, or environment naming patterns. This rule specifically looks for commands like 'mount', 'cat', 'grep', 'bash', or 'sh' being executed with command-line arguments that include 'mount' and PeopleSoft-related terms ('psoft', 'ps_config', 'nfs'), or '/etc/hosts' with PeopleSoft-related terms ('psoft', 'csprd', 'peoplesoft', 'psft').