Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts

title: Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
id: 27b8d0c5-c2f4-44ba-9afb-0d426552e8c1
status: test
description: This rule matches Linux file events where the target filename ends with specific strings associated with suspected Barracuda ESG exploitation artifacts. Attackers may use these files as part of staging, persistence (for example, cron-related script names), or malicious component deployment. Telemetry required is Linux file event logging that includes the target filename and supports suffix-based filename matching.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_file_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
modified: 2025-08-19
tags:
  - attack.execution
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - /11111.tar
      - /aacore.sh
      - /appcheck.sh
      - /autoins
      - /BarracudaMailService
      - /etc/cron.daily/core_check.sh
      - /etc/cron.daily/core.sh
      - /etc/cron.hourly/aacore.sh
      - /etc/cron.hourly/appcheck.sh
      - /etc/cron.hourly/core.sh
      - /get_fs_info.pl
      - /imgdata.jpg
      - /install_att_v2.tar
      - /install_bvp74_auth.tar
      - /install_helo.tar
      - /install_reuse.tar
      - /intent_helo
      - /intent_reuse
      - /intentbas
      - /mod_attachment.lua
      - /mod_content.lua
      - /mod_require_helo.lua
      - /mod_rtf
      - /mod_sender.lua
      - /mod_udp.so
      - /nfsd_stub.ko
      - /resize_reisertab
      - /resize_risertab
      - /resize2fstab
      - /rverify
      - /saslautchd
      - /sendscd
      - /snapshot.tar
      - /tmp/p
      - /tmp/p7
      - /tmp/t
      - /update_v2.sh
      - /update_v31.sh
      - /update_v35.sh
      - /update_version
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 5627c337-a9b2-407a-a82d-5fd97035ff39
    type: derived