Sunturai
Back to results
LowSigmaHQMilad Cheraghi

System Info Discovery via Sysinfo Syscall

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools…

Description

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
linux
Log source service
auditd

Known benign triggers

  • Legitimate administrative activity

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice