Linux File Creation with /mail/tmp/{3 alnum}{3 digits}.tar.gz Pattern

title: Linux File Creation with /mail/tmp/{3 alnum}{3 digits}.tar.gz Pattern
id: 0f1d261c-9988-4e42-aced-bbb14dcf1e37
status: test
description: This rule matches Linux file events where the target filename follows a specific pattern under /mail/tmp, ending in .tar.gz. Attackers commonly stage data as archives before collection or exfiltration, and constrained naming patterns can help them automate workflows. The detection relies on file-event telemetry that includes TargetFilename and supports regular expression matching on the full path/name.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_exfil_mail_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|re: /mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}\.tar\.gz
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0785f462-60b0-4031-9ff4-b4f3a0ba589a
    type: derived