Shell or Interpreter Executed From Non-Standard Path on Linux

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a shell binary executed from a path outside standard system locations. After gaining initial code execution on a Linux host, threat actors commonly copy or rename shell binaries (bash, sh, dash) into world-writable directories to masquerade as legitimate processes to evade detections. In privilege escalation scenarios, the copied shell is additionally granted the SUID bit via chmod so that subsequent invocations run as root regardless of the calling user's privileges.

2026-10-05 00:00:00

None

3025d15d-b0ad-490d-adf3-5787153d3a5e

attack.execution attack.t1059 attack.stealth attack.t1036.005

Nextron Sigma feed only (private)