Suspicious Reading of procfs Syscall File

  1[metadata]
  2creation_date = "2026/08/25"
  3integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/08/31"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects command lines that reference another process or thread's procfs syscall file. The
 11"/proc/<pid>/syscall" interface exposes the current syscall arguments, stack pointer, and instruction
 12pointer, which can support process discovery and preparation for process injection. Self and thread-self
 13aliases are excluded.
 14"""
 15from = "now-9m"
 16index = [
 17    "endgame-*",
 18    "logs-crowdstrike.fdr*",
 19    "logs-endpoint.events.process*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Suspicious Reading of procfs Syscall File"
 25note = """ ## Triage and analysis
 26
 27> **Disclaimer**:
 28> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 29
 30### Investigating Suspicious Reading of procfs Syscall File
 31
 32This rule detects Linux utilities reading another process or thread’s `/proc/<pid>/syscall` file, which exposes its active system call, arguments, stack pointer, and instruction pointer and can support process discovery or injection preparation. An attacker may repeatedly run `cat /proc/1234/syscall` to inspect a privileged service’s execution state before selecting it as an injection target.
 33
 34### Possible investigation steps
 35
 36- Resolve the referenced PID to its executable, owner, privileges, container or namespace, and service role to determine why it was targeted.
 37- Review the reader’s full command line, parent process, user, working directory, executable path, hash, signature, and surrounding process tree for evidence of scripts, shells, or unauthorized tooling.
 38- Correlate nearby activity for repeated procfs enumeration, `ptrace` use, debugger attachment, access to `/proc/<pid>/mem` or `/proc/<pid>/maps`, suspicious signal delivery, and credential or privilege changes.
 39- Compare the activity with host baselines and approved monitoring or troubleshooting workflows, then examine whether the same user, binary, or command pattern appears on other systems.
 40- If unexplained or malicious, isolate the host, preserve process and audit telemetry, terminate unauthorized processes, revoke exposed credentials, and investigate the initial access and persistence mechanism.
 41
 42### False positive analysis
 43
 44- An administrator troubleshooting a stalled or high-resource process may read its `/proc/<pid>/syscall` file; confirm the target PID, initiating user, parent shell, timing, and alignment with an approved support activity.
 45- An authorized diagnostic or monitoring script may periodically inspect process syscall state using standard Linux utilities; verify the script path, owner, execution schedule, expected target processes, and consistency with the host’s established baseline.
 46
 47### Response and remediation
 48
 49- Isolate the affected Linux host or container while preserving volatile evidence, including the reader process, targeted PID, process tree, open files, network connections, and relevant `/proc` artifacts.
 50- Terminate unauthorized processes and remove persistence associated with the activity, including malicious systemd units, cron entries, shell startup modifications, container hooks, kernel modules, and altered binaries.
 51- Revoke credentials or tokens accessible to the implicated accounts and processes, rotate affected secrets, and review privileged accounts for unauthorized SSH keys or sudo configuration changes.
 52- Escalate immediately to incident response if the activity includes `ptrace`, access to `/proc/<pid>/mem` or `/proc/<pid>/maps`, code injection indicators, privileged-process targeting, credential theft, or similar behavior on multiple systems.
 53- Rebuild compromised hosts or containers from verified images, restore validated data and configuration, patch exploited software, and confirm that unauthorized files, processes, accounts, and connections are absent before reconnecting them.
 54- Harden the environment by restricting procfs visibility with `hidepid`, enforcing least privilege and ptrace restrictions, strengthening SELinux or AppArmor policies, limiting debugging tools, and monitoring repeated access to other processes’ procfs files.
 55"""
 56references = [
 57  "https://man7.org/linux/man-pages/man5/proc_pid_syscall.5.html",
 58  "https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection"
 59]
 60risk_score = 47
 61rule_id = "6327bdae-4dc4-4e2e-b29d-3fd100af522c"
 62severity = "medium"
 63tags = [
 64    "Domain: Endpoint",
 65    "OS: Linux",
 66    "Platform: Linux",
 67    "Use Case: Threat Detection",
 68    "Tactic: Discovery",
 69    "Data Source: Elastic Defend",
 70    "Data Source: Elastic Endgame",
 71    "Data Source: Crowdstrike",
 72    "Data Source: SentinelOne",
 73    "Resources: Investigation Guide",
 74]
 75timestamp_override = "event.ingested"
 76type = "eql"
 77query = '''
 78process where host.os.type == "linux" and event.type == "start" and
 79event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
 80(
 81  process.name in (
 82    "cat", "less", "more", "head", "tail", "nano", "vi", "vim", "strings", "nvim", "vim.basic",
 83    "vim.tiny", "od", "hexdump", "xxd", "hx", "hexedit", "pager", "tr"
 84  ) or
 85  (
 86    process.name in (
 87      "find", "awk", "gawk", "mawk", "nawk", "grep", "fgrep", "rgrep", "xargs", "sed", "tee"
 88    ) and
 89    process.args_count <= 20
 90  )
 91) and
 92process.command_line like "*/proc/*/syscall*" and
 93not (
 94  process.command_line like ("*/proc/self/syscall*", "*/proc/thread-self/syscall*") or
 95  process.args like "/proc/*/syscall/comm"
 96)
 97'''
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101
102  [rule.threat.tactic]
103  name = "Discovery"
104  id = "TA0007"
105  reference = "https://attack.mitre.org/tactics/TA0007/"
106
107  [[rule.threat.technique]]
108  name = "Process Discovery"
109  id = "T1057"
110  reference = "https://attack.mitre.org/techniques/T1057/"