Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
Flags Linux file creation/access events whose filenames end with known Barracuda ESG exploitation artifact indicators.
FreeReviewedSigma · High · v5
- Product
- linux
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
What it detects
This rule flags Linux file system events where the target filename ends with one of several hardcoded paths and filenames associated with suspected Barracuda ESG exploitation artifacts. Attackers may use these specific files and payload names to deploy, persist, or stage additional components during exploitation. The detection relies on Linux file event telemetry that includes the target filename and supports suffix matching.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-file-indicators-matching-suspected-barracuda-esg-exploitation-artifacts-5627c337
title: Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
id: 27b8d0c5-c2f4-44ba-9afb-0d426552e8c1
status: test
description: This rule flags Linux file system events where the target filename ends with one of several hardcoded paths and filenames associated with suspected Barracuda ESG exploitation artifacts. Attackers may use these specific files and payload names to deploy, persist, or stage additional components during exploitation. The detection relies on Linux file event telemetry that includes the target filename and supports suffix matching.
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_file_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
modified: 2025-08-19
tags:
- attack.execution
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|endswith:
- /11111.tar
- /aacore.sh
- /appcheck.sh
- /autoins
- /BarracudaMailService
- /etc/cron.daily/core_check.sh
- /etc/cron.daily/core.sh
- /etc/cron.hourly/aacore.sh
- /etc/cron.hourly/appcheck.sh
- /etc/cron.hourly/core.sh
- /get_fs_info.pl
- /imgdata.jpg
- /install_att_v2.tar
- /install_bvp74_auth.tar
- /install_helo.tar
- /install_reuse.tar
- /intent_helo
- /intent_reuse
- /intentbas
- /mod_attachment.lua
- /mod_content.lua
- /mod_require_helo.lua
- /mod_rtf
- /mod_sender.lua
- /mod_udp.so
- /nfsd_stub.ko
- /resize_reisertab
- /resize_risertab
- /resize2fstab
- /rverify
- /saslautchd
- /sendscd
- /snapshot.tar
- /tmp/p
- /tmp/p7
- /tmp/t
- /update_v2.sh
- /update_v31.sh
- /update_v35.sh
- /update_version
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 5627c337-a9b2-407a-a82d-5fd97035ff39
type: derived