Rule Info
Name
Potentially Suspicious Execution From Tmp Folder
Author
Joseliyo Sanchez, @Joseliyo_Jstnk
Description
Detects a potentially suspicious execution of a process located in the '/tmp/' folder
Date
2023-06-02 00:00:00
Modified
None
Id
312b42b1-bded-4441-8b58-163a3af58775
Tags
attack.defense_evasion attack.t1036 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`
2024-04-01
Scan your endpoints, forensic images or collected files with our portable scanner THOR