Suspicious Reading of procfs Syscall File

 1[metadata]
 2creation_date = "2026/08/25"
 3integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2026/08/25"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects command lines that reference another process or thread's procfs syscall file. The
11"/proc/<pid>/syscall" interface exposes the current syscall arguments, stack pointer, and instruction
12pointer, which can support process discovery and preparation for process injection. Self and thread-self
13aliases are excluded.
14"""
15from = "now-9m"
16index = [
17    "endgame-*",
18    "logs-crowdstrike.fdr*",
19    "logs-endpoint.events.process*",
20    "logs-sentinel_one_cloud_funnel.*",
21]
22language = "eql"
23license = "Elastic License v2"
24name = "Suspicious Reading of procfs Syscall File"
25references = [
26  "https://man7.org/linux/man-pages/man5/proc_pid_syscall.5.html",
27  "https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection"
28]
29risk_score = 47
30rule_id = "6327bdae-4dc4-4e2e-b29d-3fd100af522c"
31severity = "medium"
32tags = [
33    "Domain: Endpoint",
34    "OS: Linux",
35    "Platform: Linux",
36    "Use Case: Threat Detection",
37    "Tactic: Discovery",
38    "Data Source: Elastic Defend",
39    "Data Source: Elastic Endgame",
40    "Data Source: Crowdstrike",
41    "Data Source: SentinelOne",
42]
43timestamp_override = "event.ingested"
44type = "eql"
45query = '''
46process where host.os.type == "linux" and event.type == "start" and
47event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
48(
49  process.name in (
50    "cat", "less", "more", "head", "tail", "nano", "vi", "vim", "strings", "nvim", "vim.basic",
51    "vim.tiny", "od", "hexdump", "xxd", "hx", "hexedit", "pager", "tr"
52  ) or
53  (
54    process.name in (
55      "find", "awk", "gawk", "mawk", "nawk", "grep", "fgrep", "rgrep", "xargs", "sed", "tee"
56    ) and
57    process.args_count <= 20
58  )
59) and
60process.command_line like "*/proc/*/syscall*" and
61not (
62  process.command_line like ("*/proc/self/syscall*", "*/proc/thread-self/syscall*") or
63  process.args like "/proc/*/syscall/comm"
64)
65'''
66
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69
70  [rule.threat.tactic]
71  name = "Discovery"
72  id = "TA0007"
73  reference = "https://attack.mitre.org/tactics/TA0007/"
74
75  [[rule.threat.technique]]
76  name = "Process Discovery"
77  id = "T1057"
78  reference = "https://attack.mitre.org/techniques/T1057/"