Skip to content
Threat Feed
Subscribe
low advisory

Unusual Linux Process Discovery Activity

An Elastic machine learning rule detects unusual Linux process discovery activity from atypical user contexts, indicating a potentially compromised account performing reconnaissance for privilege escalation or persistence on Linux systems.

This brief describes an Elastic machine learning rule designed to detect unusual Linux process discovery activity. Developed by Elastic, this rule identifies atypical command usage patterns from unexpected user contexts, which can indicate a compromised account attempting to map software applications. Such activity is a critical precursor for threat actors seeking to understand the environment, potentially identifying vulnerabilities for privilege escalation or planning persistence mechanisms. The detection capability is based on a machine learning job (v3_linux_system_process_discovery_ea) and requires data from Elastic Defend or Auditd Manager integrations. This rule targets Linux operating systems and aims to provide early warning of attacker reconnaissance.

Attack Chain

This brief describes a detection mechanism for an attacker technique rather than a specific multi-stage attack campaign. The detection focuses on the "Discovery" phase where an attacker, having gained initial access, attempts to understand the system environment.

Impact

Successful undetected unusual process discovery can provide threat actors with crucial insights into a targeted Linux system's running applications and configurations. This information enables them to identify potential vulnerabilities for exploitation, craft effective privilege escalation techniques, or establish persistent access. While no specific victim counts or sectors are mentioned, the impact is systemic, potentially leading to unauthorized data access, system control, or further lateral movement within the compromised environment. Early detection is vital to prevent subsequent, more damaging stages of an attack.

Recommendation

  • Deploy the Unusual Linux Process Discovery Activity machine learning rule (rule_id: 5c983105-4681-46c3-9890-0c66d05e776b) to your Elastic Security environment.
  • Ensure either the Elastic Defend or Auditd Manager integration is properly configured and sending data to your Elastic Security instance to feed the associated Machine Learning job.
  • Investigate alerts generated by the Unusual Linux Process Discovery Activity rule by reviewing the user context, command history, source IP, and authentication logs as described in the Triage and Analysis section.
  • Configure exceptions for known legitimate administrative tasks, automated scripts, or developer activity that might trigger false positives, referencing the false_positives field in the rule definition.