Skip to content
Threat Feed
Subscribe
low advisory

System Network Connections Discovery - Linux

This brief details the detection of common Linux utilities that may be used to enumerate active network connections, open ports, and listening services.

Triage facts

Revision 1
Evidence
Unknown
Severity
Low
Sources
5 public sources
Freshness
Revision 1Nov 3, 12:50 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Adversaries may use tools such as netstat, ss, lsof, or sockstat to enumerate active connections, open ports, and listening services on a compromised system.

Legitimate administration activities may also utilize these utilities, which can result in false positives.

Detection coverage 1

System Network Connections Discovery - Linux

low
sigma tactics: discovery techniques: T1049 sources: process_creation, linux

Detection queries are available on the platform. Get full rules →