Linux Auditd: Program Executions from Suspicious Web and Data Directories

ATT&CK techniques

Resource Dev

Recon
Resource Dev
- T1584Compromise Infrastructure
- T1587Develop Capabilities
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process executions where the executable path starts with commonly abused non-program directories associated with web, data, and service configuration locations. Attackers often place or run malicious binaries from writable or misused paths like web document roots or database/service data directories to evade standard application controls. It relies on Linux auditd syscall telemetry identifying the executed executable path via the SYSCALL event type.

Reporting behind it

Related detections8 linkedT1587 — drag to rearrange

Proxy WebDAV MiniRedir Drives Execution from External Shares

Windows WebDAV Temporary File Creation with Suspicious Extensions

Linux process execution matches known hacktools by image name

Windows System Logs: Windows Update Client errors (connection, install, uninstall, revert, commit)

Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll

Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation

Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation

Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata

Linux Auditd: Program Executions from Suspicious Web and Data Directories

Pivot detection · T1587 · 8 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-program-execution-from-suspicious-directories-a39d7fa7

title: "Linux Auditd: Program Executions from Suspicious Web and Data Directories"
id: cddddc7f-eed4-4694-b10f-612119dfc909
status: test
description: This rule flags Linux process executions where the executable path starts with commonly abused non-program directories associated with web, data, and service configuration locations. Attackers often place or run malicious binaries from writable or misused paths like web document roots or database/service data directories to evade standard application controls. It relies on Linux auditd syscall telemetry identifying the executed executable path via the SYSCALL event type.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-01-23
modified: 2021-11-27
tags:
  - attack.t1587
  - attack.t1584
  - attack.resource-development
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    exe|startswith:
      - /tmp/
      - /var/www/
      - /home/*/public_html/
      - /usr/local/apache2/
      - /usr/local/httpd/
      - /var/apache/
      - /srv/www/
      - /home/httpd/html/
      - /srv/http/
      - /usr/share/nginx/html/
      - /var/lib/pgsql/data/
      - /usr/local/mysql/data/
      - /var/lib/mysql/
      - /var/vsftpd/
      - /etc/bind/
      - /var/named/
  condition: selection
falsepositives:
  - Admin activity (especially in /tmp folders)
  - Crazy web applications
level: medium
license: DRL-1.1
related:
  - id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL