huntrule

Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts

Flags Linux file creation/access events whose filenames end with known Barracuda ESG exploitation artifact indicators.

FreeReviewedSigma · High · v5
Product
linux
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-06-16
Updated
2026-07-31
AnalysisDetection
title: Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
id: 27b8d0c5-c2f4-44ba-9afb-0d426552e8c1
status: test
description: This rule flags Linux file system events where the target filename ends with one of several hardcoded paths and filenames associated with suspected Barracuda ESG exploitation artifacts. Attackers may use these specific files and payload names to deploy, persist, or stage additional components during exploitation. The detection relies on Linux file event telemetry that includes the target filename and supports suffix matching.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_file_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
modified: 2025-08-19
tags:
  - attack.execution
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - /11111.tar
      - /aacore.sh
      - /appcheck.sh
      - /autoins
      - /BarracudaMailService
      - /etc/cron.daily/core_check.sh
      - /etc/cron.daily/core.sh
      - /etc/cron.hourly/aacore.sh
      - /etc/cron.hourly/appcheck.sh
      - /etc/cron.hourly/core.sh
      - /get_fs_info.pl
      - /imgdata.jpg
      - /install_att_v2.tar
      - /install_bvp74_auth.tar
      - /install_helo.tar
      - /install_reuse.tar
      - /intent_helo
      - /intent_reuse
      - /intentbas
      - /mod_attachment.lua
      - /mod_content.lua
      - /mod_require_helo.lua
      - /mod_rtf
      - /mod_sender.lua
      - /mod_udp.so
      - /nfsd_stub.ko
      - /resize_reisertab
      - /resize_risertab
      - /resize2fstab
      - /rverify
      - /saslautchd
      - /sendscd
      - /snapshot.tar
      - /tmp/p
      - /tmp/p7
      - /tmp/t
      - /update_v2.sh
      - /update_v31.sh
      - /update_v35.sh
      - /update_version
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 5627c337-a9b2-407a-a82d-5fd97035ff39
    type: derived