Linux Process Execution of BarracudaMailService and Resize Utility Binaries

Alerts on Linux process creation for executables ending with three specific names linked to SEASPY deployment.

FreeReviewedSigma · Critical · v5
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-06-16
Updated
2026-07-31
title: Linux Process Execution of BarracudaMailService and Resize Utility Binaries
id: 12f2a235-f520-44bb-974c-0d41dc8d7962
status: test
description: "This rule identifies Linux process creation events where the executed image path ends with one of three specific binary names: /BarracudaMailService, /resize2fstab, or /resize_reisertab. Attackers frequently rely on staged or bundled executables to establish persistence or deploy payloads, making targeted binary execution a useful behavior signal. The detection relies on process creation telemetry that includes the executed image path."
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_atp_unc4841_seaspy_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /BarracudaMailService
      - /resize2fstab
      - /resize_reisertab
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: f6a711f3-d032-4f9e-890b-bbe776236c84
    type: derived