splunk-security_content/lookups/linux_tool_discovery_process.csv

1	process
2	cat /proc/version
3	cat /etc/*-release
4	/etc/passwd
5	cat /etc/*
6	lastlog
7	id
8	PermitRootLogin
9	sestatus *
10	ps
11	mysql*
12	netstat*
13	find *
14	head /var/mail/root
15	docker
16	cat /etc/issue
17	cat /etc/*-release
18	cat /proc/version
19	uname -a
20	uname -mrs
21	rpm -q kernel
22	dmesg | grep Linux
23	ls /boot | grep vmlinuz-
24	cat /etc/profile
25	cat /etc/bashrc
26	cat ~/.bash_profile
27	cat ~/.bashrc
28	cat ~/.bash_logout
29	ps -aux | grep root
30	ps -ef | grep root
31	crontab -l
32	cat /etc/cron*
33	cat /etc/cron.allow
34	cat /etc/cron.deny
35	cat /etc/crontab
36	grep -i user *
37	grep -i pass *
38	ifconfig
39	cat /etc/network/interfaces
40	cat /etc/sysconfig/network
41	cat /etc/resolv.conf
42	cat /etc/networks
43	cvelist-file:*
44	exploit-db*
45	strings -e /etc/apache2/apache2.conf
46	strings -e /etc/ssh/sshd_config
47	strings -e /etc/shadow
48	iptables -L
49	lsof -i
50	netstat -antup
51	netstat -antpx
52	netstat -tulpn
53	arp -e
54	route
55	cat /etc/passwd
56	cat /etc/group
57	cat /etc/shadow
58	find / -perm -u=s
59	find / -perm -g=s
60	find / -perm -4000
61	find / -perm -2000