Linux Email Exfiltration Staging File Pattern Matching (/mail/tmp/**.tar.gz)
Flags Linux file events creating /mail/tmp staging archives named like abc123.tar.gz.
FreeReviewedSigma · High · v5
- Product
- linux
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
What it detects
This rule flags Linux file creation or modification events where the target filename matches a specific email-related staging and exfiltration pattern under /mail/tmp/. Attackers may use predictable temporary filenames and compressed archives to stage data for later collection. The detection relies on file event telemetry that includes the target filename and supports regex-based matching.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-file-creation-with-mail-tmp-3-alnum-3-digits-tar-gz-pattern-0785f462
title: Linux Email Exfiltration Staging File Pattern Matching (/mail/tmp/**.tar.gz)
id: 0f1d261c-9988-4e42-aced-bbb14dcf1e37
status: test
description: This rule flags Linux file creation or modification events where the target filename matches a specific email-related staging and exfiltration pattern under /mail/tmp/. Attackers may use predictable temporary filenames and compressed archives to stage data for later collection. The detection relies on file event telemetry that includes the target filename and supports regex-based matching.
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_exfil_mail_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
- attack.execution
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|re: /mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}\.tar\.gz
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0785f462-60b0-4031-9ff4-b4f3a0ba589a
type: derived