SG-019: Environment Probing

Severity: HIGH

System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes

Fires when

• Shell-context identity/OS recon commands (whoami, hostname, uname -a, id UID/GID probe, /etc/passwd or /etc/os-release read).
• Environment or credential dumps (printenv, `env | grep` for key/token/secret, listing/reading ~/.ssh, ~/.aws, ~/.kube).
• Process, network-interface, or cloud/container identity enumeration (ps aux, netstat, aws sts get-caller-identity, kubectl config, docker inspect).
• Network scanning or cloud instance-metadata (IMDS) probes (nmap/masscan, dig/nslookup, curl 169.254.169.254, metadata.google.internal).

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://attack.mitre.org/techniques/T1082/