Recursive search for sensitive files under a shared root

Siemphony@siemphonymediumT1005unverified

Matches a find or grep execution that names a broad filesystem root and a sensitive file type or credential filename in the same command line, which is AN1071's "recursively enumerate user home directories, config files, or SSH keys". The rule is deliberately shaped on the search step rather than on what happens afterwards: MITRE's ScriptToolName knob names find, grep, tar and scp, but tar and scp are dropped here because compression and transfer are already covered by the archiving and exfiltration techniques, and keeping them would make this a second copy of those rules instead of the collection step that precedes them. locate and plocate were considered for the tool list and left out because neither takes a directory argument, so they could never satisfy the root gate and would be a selector that can never fire; find and grep are both real ELF binaries, so the auditd exe= field names them rather than a wrapper shell. Prerequisite: this needs an auditd rule arming the execve syscall (for example -a always,exit -F arch=b64 -S execve), which is absent from a default install on every mainstream distribution — without it the rule returns nothing and the silence means the syscall is not being recorded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0380, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/find" or FolderPath endswith "/grep") and (ProcessCommandLine contains " /home" or ProcessCommandLine contains " /root" or ProcessCommandLine contains " /srv" or ProcessCommandLine contains " /var/www" or ProcessCommandLine contains " /opt" or ProcessCommandLine contains " /mnt" or ProcessCommandLine contains " /media" or ProcessCommandLine contains " /export")) and (ProcessCommandLine contains "id_rsa" or ProcessCommandLine contains "id_ed25519" or ProcessCommandLine contains "id_ecdsa" or ProcessCommandLine contains "authorized_keys" or ProcessCommandLine contains "/.ssh" or ProcessCommandLine contains "/.aws" or ProcessCommandLine contains "/.kube" or ProcessCommandLine contains ".git-credentials" or ProcessCommandLine contains ".netrc" or ProcessCommandLine contains ".pgpass" or ProcessCommandLine contains ".kdbx" or ProcessCommandLine contains ".ovpn" or ProcessCommandLine contains ".docx" or ProcessCommandLine contains ".xlsx" or ProcessCommandLine contains ".pdf" or ProcessCommandLine contains ".sql"))

Splunk · SPL

Run this as a search.

index=* (((Image="*/find" OR Image="*/grep") AND (CommandLine="* /home*" OR CommandLine="* /root*" OR CommandLine="* /srv*" OR CommandLine="* /var/www*" OR CommandLine="* /opt*" OR CommandLine="* /mnt*" OR CommandLine="* /media*" OR CommandLine="* /export*")) AND (CommandLine="*id_rsa*" OR CommandLine="*id_ed25519*" OR CommandLine="*id_ecdsa*" OR CommandLine="*authorized_keys*" OR CommandLine="*/.ssh*" OR CommandLine="*/.aws*" OR CommandLine="*/.kube*" OR CommandLine="*.git-credentials*" OR CommandLine="*.netrc*" OR CommandLine="*.pgpass*" OR CommandLine="*.kdbx*" OR CommandLine="*.ovpn*" OR CommandLine="*.docx*" OR CommandLine="*.xlsx*" OR CommandLine="*.pdf*" OR CommandLine="*.sql*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/find" OR TO_LOWER(process.executable) LIKE "*/grep") AND (TO_LOWER(process.command_line) LIKE "* /home*" OR TO_LOWER(process.command_line) LIKE "* /root*" OR TO_LOWER(process.command_line) LIKE "* /srv*" OR TO_LOWER(process.command_line) LIKE "* /var/www*" OR TO_LOWER(process.command_line) LIKE "* /opt*" OR TO_LOWER(process.command_line) LIKE "* /mnt*" OR TO_LOWER(process.command_line) LIKE "* /media*" OR TO_LOWER(process.command_line) LIKE "* /export*")) AND (TO_LOWER(process.command_line) LIKE "*id_rsa*" OR TO_LOWER(process.command_line) LIKE "*id_ed25519*" OR TO_LOWER(process.command_line) LIKE "*id_ecdsa*" OR TO_LOWER(process.command_line) LIKE "*authorized_keys*" OR TO_LOWER(process.command_line) LIKE "*/.ssh*" OR TO_LOWER(process.command_line) LIKE "*/.aws*" OR TO_LOWER(process.command_line) LIKE "*/.kube*" OR TO_LOWER(process.command_line) LIKE "*.git-credentials*" OR TO_LOWER(process.command_line) LIKE "*.netrc*" OR TO_LOWER(process.command_line) LIKE "*.pgpass*" OR TO_LOWER(process.command_line) LIKE "*.kdbx*" OR TO_LOWER(process.command_line) LIKE "*.ovpn*" OR TO_LOWER(process.command_line) LIKE "*.docx*" OR TO_LOWER(process.command_line) LIKE "*.xlsx*" OR TO_LOWER(process.command_line) LIKE "*.pdf*" OR TO_LOWER(process.command_line) LIKE "*.sql*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/find$|/grep$)</field>    <field name="CommandLine" type="pcre2">(?i)( /home| /root| /srv| /var/www| /opt| /mnt| /media| /export)</field>    <field name="CommandLine" type="pcre2">(?i)(id_rsa|id_ed25519|id_ecdsa|authorized_keys|/\.ssh|/\.aws|/\.kube|\.git-credentials|\.netrc|\.pgpass|\.kdbx|\.ovpn|\.docx|\.xlsx|\.pdf|\.sql)</field>    <description>Recursive search for sensitive files under a shared root</description>    <mitre>      <id>T1005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 373b7899-fe6f-492b-9a74-5209b73e39b4

ATT&CKT1005

T1005Data from Local System

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN1071 describes "recursively enumerate user home directories, config files, or SSH keys" using bash-scriptable tools. This rule catches the search step: a find or grep execution that names a broad filesystem root and a sensitive filename or extension in the same command line. MITRE's ScriptToolName knob names four tools — find, grep, tar, scp — and the rule author deliberately kept only the first two: tar and scp are dropped because compression and transfer are already covered by this corpus's archiving and exfiltration rules, and keeping them here would just duplicate those rules instead of covering the collection step that precedes them. locate/plocate were considered and rejected because neither takes a directory argument, so they could never satisfy the root gate — a selector that can never fire.

02 · Telemetry you need

auditd:SYSCALL::execve, rendered as category: process_creation / product: linux, copied verbatim from AN1071. This needs an auditd rule arming the execve syscall (-a always,exit -F arch=b64 -S execve), which is absent from a default install on every mainstream distribution — without it the rule returns nothing, and that silence means unrecorded, not clean, as the rule's own description states.
Of AN1071's two knobs, ScriptToolName is implemented (as find/grep); TimeWindow needs the aggregation this single-event rule doesn't have — a scripted sweep across many files would need a correlation engine to establish, and Sigma has no aggregation construct for it.

03 · How the logic works

Three selections, all ANDed. selection_search_tool matches Image|endswith on /find or /grep — real ELF binaries, so auditd's exe= field names them directly rather than a wrapper shell. selection_broad_root matches CommandLine|contains against eight leading-space root fragments: ' /home', ' /root', ' /srv', ' /var/www', ' /opt', ' /mnt', ' /media', ' /export'. selection_sensitive_target matches CommandLine|contains against sixteen terms split across two families — SSH/cloud/credential artefacts (id_rsa, id_ed25519, id_ecdsa, authorized_keys, /.ssh, /.aws, /.kube, .git-credentials, .netrc, .pgpass, .kdbx, .ovpn) and plain document extensions (.docx, .xlsx, .pdf, .sql). None of this list comes from MITRE's brief; ScriptToolName is the only knob MITRE names, and even that the author narrowed from four tools to two.

04 · Common false positives

The review's central finding is that the document-extension half of selection_sensitive_target is what breaks the calibration. The first false positive names find /home -name '*.pdf' as "byte-for-byte the command an operator runs" and "the loudest entry here by a wide margin" — storage reporting, quota jobs, and cleanup sweeps on any file server. All four false-positive entries describe routine, high-frequency automation; none describes something rare. That pattern argues for level: low, not the medium the rule ships at, per the contract's rule that the level answers to the top entry.
The review also flags a false-negative the description doesn't mention: the broad-root gate is a contains on a leading space, so cd /home && find . -name id_rsa, find ~ -name id_rsa, and find $HOME all miss it even though they're the same sweep. The root gate adds little precision beyond what the target list already provides, while quietly excluding common invocation forms.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: run read-only, rank hits by `CommandLine`, and confirm hardening/compliance scanners (Lynis, OpenSCAP, vulnerability agents) dominate before setting the credential-only scope.
tier_3: ** add MITRE's TimeWindow correlation across multiple sensitive-file accesses to distinguish a single lookup from a scripted sweep.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Drop the document extensions (.docx, .xlsx, .pdf, .sql) and keep
Scope the remaining noise (SSH-hygiene audits, compliance scanners) on
Evasion is a wildcard away: find /home -name 'id_*' never matches the
Build a Windows companion from AN1070 (PowerShell/WMI file collection) —

Declared by the author

Storage reporting, quota enforcement and cleanup jobs that sweep every user directory for document types on a schedule — find /home -name '*.pdf' is the canonical form and is byte-for-byte the command an operator runs. On a file server or shared login host this is the loudest entry here by a wide margin, and MITRE's ScriptToolName knob is the wrong place to suppress it because the tool is the same; scope it on the service account and the cron window instead.
Backup and data-loss-prevention pre-scan agents that enumerate documents under /home, /srv and /var/www before each run, producing a predictable nightly burst from a small set of accounts.
Administrators auditing SSH key hygiene with find /home -name authorized_keys or find /home -name id_rsa, a standard compliance check that matches all three selections without anything unusual happening.
Developers hunting for a misplaced credential or config file in a shared checkout under /opt or /srv with a recursive grep, which matches the root and the target term with no collection intent behind it.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1005, evaluated against their process_creation events.

Share this rule

/u/siemphony/373b7899-fe6f-492b-9a74-5209b73e39b4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Recursive search for sensitive files under a shared root

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it