Linux auditd: Program execution from suspicious directories

Alerts on Linux process creation when the executed binary path begins with commonly abused temp/web/data directories.

FreeUnreviewedSigmamediumv1

linux-auditd-program-execution-from-suspicious-directories-a39d7fa7

title: "Linux auditd: Program execution from suspicious directories"
id: cddddc7f-eed4-4694-b10f-612119dfc909
status: test
description: This rule flags process executions where the executable path starts with commonly abused directories such as /tmp, web root paths (e.g., /var/www, /usr/local/apache2), service data directories (e.g., MySQL/PostgreSQL, FTP, DNS), and related system paths. Attackers often run malware or web-related payloads from these locations to blend in with normal application structure or to leverage writable temporary and data directories. It relies on Linux auditd SYSCALL telemetry and matches the executed binary path prefix.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-01-23
modified: 2021-11-27
tags:
  - attack.t1587
  - attack.t1584
  - attack.resource-development
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    exe|startswith:
      - /tmp/
      - /var/www/
      - /home/*/public_html/
      - /usr/local/apache2/
      - /usr/local/httpd/
      - /var/apache/
      - /srv/www/
      - /home/httpd/html/
      - /srv/http/
      - /usr/share/nginx/html/
      - /var/lib/pgsql/data/
      - /usr/local/mysql/data/
      - /var/lib/mysql/
      - /var/vsftpd/
      - /etc/bind/
      - /var/named/
  condition: selection
falsepositives:
  - Admin activity (especially in /tmp folders)
  - Crazy web applications
level: medium
license: DRL-1.1
related:
  - id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc
    type: derived

What it detects

This rule flags process executions where the executable path starts with commonly abused directories such as /tmp, web root paths (e.g., /var/www, /usr/local/apache2), service data directories (e.g., MySQL/PostgreSQL, FTP, DNS), and related system paths. Attackers often run malware or web-related payloads from these locations to blend in with normal application structure or to leverage writable temporary and data directories. It relies on Linux auditd SYSCALL telemetry and matches the executed binary path prefix.

Known false positives

Admin activity (especially in /tmp folders)
Crazy web applications

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.