Query: Sigma rule for Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load
Matching passage: Sigma rule: Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load. Logsource: linux / auditd. Rule: title: System Info Discovery via Sysinfo Syscall id: b207d563-a1d9-4275-b349-77d1eb55aa6d status: experimental description: 'Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it''s a viable target. ' references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md - https://man7.org/linux/man-pages/man2/sysinfo.2.html author: Milad Cheraghi date: 2025-05-30 modified: 2025-12-05 tags: - attack.discovery - attack.t1057 - attack.t1082 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall ' detection: selection: type: SYSCALL SYSCALL: sysinfo filter_optional_splunk: exe|endswith: /bin/splunkd condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware. Logsource: windows / registry_set. Rule: title: AMSI Disabled via Registry Modification id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 related: - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 type: similar status: experimental description: 'Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned. ' references: - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0