{"id":"T1592.004","name":"Client Configurations","url":"https://attack.mitre.org/techniques/T1592/004","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0820","stix_id":"x-mitre-detection-strategy--87cb2c80-54e1-4ea1-abd7-81a096eb155e","name":"Detection of Client Configurations","url":"https://attack.mitre.org/detectionstrategies/DET0820","analytics":[{"id":"AN1952","stix_id":"x-mitre-analytic--3d01d29d-30f1-4b3b-bf04-54aca340a8eb","name":"Analytic 1952","description":"Internet scanners may be used to look for patterns associated with malicious content designed to collect client configuration information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox)\nMuch of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0820#AN1952","platforms":["PRE"],"log_source_references":[{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0820"],"techniques":["T1592.004"]}],"live":true,"version":"1.0","techniques":["T1592.004"]}],"sigma_rules":[{"id":"0cf7a157-8879-41a2-8f55-388dd23746b7","title":"Linux Recon Indicators","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-20","modified":null,"description":"Detects events with patterns found in commands used for reconnaissance on linux systems","references":["https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1592.004","attack.credential-access","attack.t1552.001"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml","techniques":["T1592.004","T1552.001"],"cves":[]},{"id":"0f79c4d2-4e1f-4683-9c36-b5469a665e06","title":"Access of Sudoers File Content","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2025-06-04","description":"Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.","references":["https://github.com/sleventyeleven/linuxprivchecker/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1592.004"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml","techniques":["T1592.004"],"cves":[]},{"id":"d7821ff1-4527-4e33-9f84-d0d57fa2fb66","title":"Print History File Contents","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2022-09-15","description":"Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance","references":["https://github.com/sleventyeleven/linuxprivchecker/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1592.004"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml","techniques":["T1592.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}