Techniques › T1480.001 › AN1306
AN1306 Analytic 1306
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Linux environmental keying behavioral chain: (1) System information gathering through native commands (uname, hostname, id, whoami, ifconfig/ip) and file system enumeration, (2) Network configuration discovery (route tables, DNS settings, network interfaces), (3) Filesystem and mount point analysis for target-specific directories or devices, (4) Process and service enumeration to identify target-specific software, (5) Cryptographic library usage correlation with collected environmental data, (6) Payload execution following successful environmental validation</p>
- Detects
- T1480.001 Environmental Keying
- Part of
- DET0474 Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis | DC0064 Command Execution |
| linux:syslog | kernel messages related to cryptographic operations, module loading, and filesystem access patterns | DC0055 File Access |
| linux:osquery | process_events | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DiscoveryCommandSequenceThreshold | Number of distinct discovery commands within time window to trigger detection - adjust based on normal system administration patterns in environment |
ProcessAncestryDepth | Depth of process parent-child relationships to analyze for discovery activity clustering - balance between detection efficacy and performance |
CryptographicLibraryIndicators | Shared libraries and system calls indicating cryptographic operations (libcrypto, libssl, openssl) - customize based on environment-specific crypto tools |
TargetSpecificFilesystems | Organization-specific mount points, network filesystems, or device paths that adversaries might validate against |
AuthorizedDiscoveryUsers | User accounts and service accounts authorized for extensive system discovery operations - maintain for false positive reduction |
NetworkConfigurationBaseline | Normal network interface configurations and routing tables to identify anomalous network discovery patterns |
ContainerContextIdentifiers | Container runtime identifiers and namespace patterns to detect environmental assessment targeting container environments |