Linux: Shell Execution Where Parent Process Runs from /tmp

Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.

FreeUnreviewedSigmahighv1

linux-shell-execution-where-parent-process-runs-from-tmp-2fade0b6

title: "Linux: Shell Execution Where Parent Process Runs from /tmp"
id: 106b9f77-d9b9-4b7a-b90c-731d4ac94022
status: test
description: This rule flags process creation events where the parent process image path starts with /tmp/ and the child process image ends with a common shell binary name (bash, sh, zsh, dash, ksh, csh, fish). Attackers often stage or unpack tooling in temporary directories and then invoke shells to run payloads or commands, making this a useful behavior indicator. It relies on Linux process creation telemetry that includes parent and executable image paths.
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
  - attack.execution
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentImage|startswith: /tmp/
    Image|endswith:
      - /bash
      - /csh
      - /dash
      - /fish
      - /ksh
      - /sh
      - /zsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2fade0b6-7423-4835-9d4f-335b39b83867
    type: derived

What it detects

This rule flags process creation events where the parent process image path starts with /tmp/ and the child process image ends with a common shell binary name (bash, sh, zsh, dash, ksh, csh, fish). Attackers often stage or unpack tooling in temporary directories and then invoke shells to run payloads or commands, making this a useful behavior indicator. It relies on Linux process creation telemetry that includes parent and executable image paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.