kevmap

TechniquesT1082 › AN1453

AN1453 Analytic 1453

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.</p>
Detects
T1082 System Information Discovery
Part of
DET0525 System Discovery via Native and Remote Utilities

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLexecveDC0032 Process Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
CommandListCustomize list of commands of interest (e.g., uname, lscpu, etc.)
TerminalSessionIDCorrelate sessions for behavior context.

KEV CVEs whose mapped technique this analytic detects

CVEVendor / productState
CVE-2019-1653Cisco Small Business RV320 and RV325 RoutersMapped
CVE-2020-8195Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceMapped
CVE-2020-8196Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceMapped
CVE-2021-40449Microsoft WindowsMapped
CVE-2023-34362Progress MOVEit TransferMapped
CVE-2023-43770Roundcube WebmailMapped
CVE-2024-23692Rejetto HTTP File ServerMapped