﻿---
title: Environment Variable Enumeration Detected via Defend for Containers
description: This rule detects the execution of the "env" or "printenv" commands inside a container. The "env" command is used to display all the environment variables...
url: https://www.elastic.co/elastic/docs-builder/docs/2564/reference/security/prebuilt-rules/rules/integrations/cloud_defend/discovery_environment_enumeration
---

# Environment Variable Enumeration Detected via Defend for Containers
This rule detects the execution of the "env" or "printenv" commands inside a container. The "env" command is used
to display all the environment variables for the current shell, and the "printenv" command is used to print the
values of environment variables. These commands are used to enumerate the environment variables of the container,
which can be used by an adversary to gain information about the container and the services running inside it.
**Rule type**: eql
**Rule indices**:
- logs-cloud_defend.process*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 5m
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: ?
**References**:
**Tags**:
- Data Source: Elastic Defend for Containers
- Domain: Container
- OS: Linux
- Use Case: Threat Detection
- Tactic: Discovery

**Version**: ?
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```eql
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.name in ("env", "printenv") or
  (
    /* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
    process.args in (
      "env", "/bin/env", "/usr/bin/env", "/usr/local/bin/env",
      "printenv", "/bin/printenv", "/usr/bin/printenv", "/usr/local/bin/printenv"
    ) and
    /* default exclusion list to not FP on default multi-process commands */
    not process.args in (
      "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
      "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
      "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
      "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
    )
  )
) and
process.interactive == true and container.id like "*"
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
- Id: TA0007
- Reference URL: [https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Container and Resource Discovery
- Id: T1613
- Reference URL: [https://attack.mitre.org/techniques/T1613/](https://attack.mitre.org/techniques/T1613/)
- Technique:
  - Name: System Information Discovery
- Id: T1082
- Reference URL: [https://attack.mitre.org/techniques/T1082/](https://attack.mitre.org/techniques/T1082/)