huntrule

Linux Auditd: Program Executions from Suspicious Web and Data Directories

Alerts on Linux process creation when the executed binary path begins with commonly abused temp/web/data directories.

FreeReviewedSigma · Medium · v3
Product
linux
Service
auditd
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-01-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Resource Dev

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process executions where the executable path starts with commonly abused non-program directories associated with web, data, and service configuration locations. Attackers often place or run malicious binaries from writable or misused paths like web document roots or database/service data directories to evade standard application controls. It relies on Linux auditd syscall telemetry identifying the executed executable path via the SYSCALL event type.

Reporting behind it

Related detections8 linkedT1587 — drag to rearrange
Proxy WebDAV MiniRedir Drives Execution from External Shares
Windows WebDAV Temporary File Creation with Suspicious Extensions
Linux process execution matches known hacktools by image name
Windows System Logs: Windows Update Client errors (connection, install, uninstall, revert, commit)
Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll
Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation
Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation
Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata
Linux Auditd: Program Executions from Suspicious Web and Data Directories
Pivot detection · T1587 · 8 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.