Shell Execution Of Process Located In Tmp Directory

Rule Info

Name

Shell Execution Of Process Located In Tmp Directory

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Description

Detects execution of shells from a parent process located in a temporary (/tmp) directory

Reference

Date

2023-06-02 00:00:00

Modified

None

2fade0b6-7423-4835-9d4f-335b39b83867

Rule History

Author

Title

Date

Commit

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

github-actions[bot]

Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`

2024-04-01

jstnk9

feat: new linux rules related to GobRAT malware (#4272)

2023-06-02