Rule Info
Name
SUSP_LNX_SH_Setsid_From_Temp_Jul26
Author
Pezier Pierre-Henri
Description
Detects suspicious invocation that runs a binary or script from /tmp with setsid
Score
60
Reference
Internal Research
Date
2026-07-02
Minimum Yara
3.5.0
Rule Hash
7b5fe81b80941e6095da13379379606b
Tags
['LINUX', 'SCRIPT', 'FILE', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
21
Clean (0 engines)
8
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR