Linux file creation via curl to /tmp/ld.py (Axios NPM compromise indicators)
Alerts on Linux file creation of /tmp/ld.py by a /curl process, consistent with automated payload staging.
FreeReviewedSigma · High · v5
- Product
- linux
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-04-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Linux file creation activity where the process image ends with '/curl' and the created file is '/tmp/ld.py'. Attackers may use curl to retrieve and stage malicious payloads during supply-chain or initial access workflows. The detection relies on file event telemetry containing the process image path and the target filename being created.
Reporting behind it
- stepsecurity.iohttps://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- derp.cahttps://www.derp.ca/research/axios-npm-supply-chain-rat/
- trendmicro.comhttps://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- elastic.cohttps://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- virustotal.comhttps://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_lnx_axios_npm_compromise_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-file-drop-indicator-for-axios-npm-supply-chain-compromise-curl-to-tmp-ld-p-b7cb840c
title: Linux file creation via curl to /tmp/ld.py (Axios NPM compromise indicators)
id: 152686e1-7edb-4633-bcd3-08d2f43fadb9
status: experimental
description: This rule flags Linux file creation activity where the process image ends with '/curl' and the created file is '/tmp/ld.py'. Attackers may use curl to retrieve and stage malicious payloads during supply-chain or initial access workflows. The detection relies on file event telemetry containing the process image path and the target filename being created.
references:
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.derp.ca/research/axios-npm-supply-chain-rat/
- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_lnx_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
- attack.initial-access
- attack.t1195.002
- attack.command-and-control
- attack.t1105
- detection.emerging-threats
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith: /curl
TargetFilename: /tmp/ld.py
condition: selection
falsepositives:
- Highly unlikely
level: high
license: DRL-1.1
related:
- id: b7cb840c-11f6-47f7-b3ef-5524739c9077
type: derived