Execution Of Script Located In Potentially Suspicious Directory

Rule Info

Name

Execution Of Script Located In Potentially Suspicious Directory

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Description

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

Reference

Date

2023-06-02 00:00:00

Modified

None

30bcce26-51c5-49f2-99c8-7b59e3af36c7

Rule History

Author

Title

Date

Commit

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

github-actions[bot]

Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`

2024-04-01

jstnk9

feat: new linux rules related to GobRAT malware (#4272)

2023-06-02