Shell Execution Of Process Located In Tmp Directory

Rule Info

Name
Shell Execution Of Process Located In Tmp Directory
Author
Joseliyo Sanchez, @Joseliyo_Jstnk
Description
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Reference
https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
Date
2023-06-02 00:00:00
Modified
None
Id
2fade0b6-7423-4835-9d4f-335b39b83867
Tags
attack.execution DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=2fade0b6-7423-4835-9d4f-335b39b83867

Rule History

Author
Title
Date
Commit
github-actions[bot]
Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`
2024-04-01
a8e1ecd65
jstnk9
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02
04cf7e9ea
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022