Linux Process Execution of Named Binaries Commonly Used for SEASPY Deployment

Alerts on Linux process creation for executables ending with three specific names linked to SEASPY deployment.

FreeUnreviewedSigmacriticalv1

linux-process-execution-of-named-binaries-commonly-used-for-seaspy-deployment-f6a711f3

title: Linux Process Execution of Named Binaries Commonly Used for SEASPY Deployment
id: 12f2a235-f520-44bb-974c-0d41dc8d7962
status: test
description: This rule flags Linux process executions where the executable path ends with one of three specific binary names associated with SEASPY deployment. Attackers may use known auxiliary tools or masqueraded utilities to establish or deliver malicious payloads, making named binary execution a useful behavioral indicator. The detection relies on process creation telemetry, specifically the full command image path for matching the configured filename endings.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_atp_unc4841_seaspy_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /BarracudaMailService
      - /resize2fstab
      - /resize_reisertab
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: f6a711f3-d032-4f9e-890b-bbe776236c84
    type: derived

What it detects

This rule flags Linux process executions where the executable path ends with one of three specific binary names associated with SEASPY deployment. Attackers may use known auxiliary tools or masqueraded utilities to establish or deliver malicious payloads, making named binary execution a useful behavioral indicator. The detection relies on process creation telemetry, specifically the full command image path for matching the configured filename endings.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.