Rule Info
Name
System Binary Copied or Moved to Suspicious Directory
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the use of cp or mv to copy or move a system binary into a suspicious writable directory.
Attackers stage LOLBins like curl or wget in memory-backed or world-writable directories
to abuse their functionality while obscuring their origin.
Date
2026-10-12 00:00:00
Modified
None
Id
5e6addda-fd1b-43cc-8229-6ba76dc518e4
Tags
attack.stealth attack.t1036.003 attack.t1564
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR