Linux Process Execution of BarracudaMailService and Resize Utility Binaries
Alerts on Linux process creation for executables ending with three specific names linked to SEASPY deployment.
FreeReviewedSigma · Critical · v5
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
What it detects
This rule identifies Linux process creation events where the executed image path ends with one of three specific binary names: /BarracudaMailService, /resize2fstab, or /resize_reisertab. Attackers frequently rely on staged or bundled executables to establish persistence or deploy payloads, making targeted binary execution a useful behavior signal. The detection relies on process creation telemetry that includes the executed image path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-process-execution-of-named-binaries-commonly-used-for-seaspy-deployment-f6a711f3
title: Linux Process Execution of BarracudaMailService and Resize Utility Binaries
id: 12f2a235-f520-44bb-974c-0d41dc8d7962
status: test
description: "This rule identifies Linux process creation events where the executed image path ends with one of three specific binary names: /BarracudaMailService, /resize2fstab, or /resize_reisertab. Attackers frequently rely on staged or bundled executables to establish persistence or deploy payloads, making targeted binary execution a useful behavior signal. The detection relies on process creation telemetry that includes the executed image path."
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_atp_unc4841_seaspy_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
- attack.execution
- detection.emerging-threats
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith:
- /BarracudaMailService
- /resize2fstab
- /resize_reisertab
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: f6a711f3-d032-4f9e-890b-bbe776236c84
type: derived