Linux: Shell Execution from /tmp by Parent Process
Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.
FreeReviewedSigma · High · v2
- Product
- linux
- Category
- process_creation
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2023-06-02
- Updated
- 2026-07-31
What it detects
This rule flags process creation on Linux where the parent process path is located under /tmp and the child process image name ends with a shell binary (/bash, /csh, /dash, /fish, /ksh, /sh, /zsh). Attackers commonly stage or execute payloads from temporary directories to evade standard expectations for system binaries. It relies on process_creation telemetry that includes full parent and child process image paths.
Reporting behind it
- blogs.jpcert.or.jphttps://blogs.jpcert.or.jp/en/2023/05/gobrat.html
- jstnk9.github.iohttps://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
- virustotal.comhttps://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
- virustotal.comhttps://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-shell-execution-where-parent-process-runs-from-tmp-2fade0b6
title: "Linux: Shell Execution from /tmp by Parent Process"
id: 106b9f77-d9b9-4b7a-b90c-731d4ac94022
status: test
description: This rule flags process creation on Linux where the parent process path is located under /tmp and the child process image name ends with a shell binary (/bash, /csh, /dash, /fish, /ksh, /sh, /zsh). Attackers commonly stage or execute payloads from temporary directories to evade standard expectations for system binaries. It relies on process_creation telemetry that includes full parent and child process image paths.
references:
- https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
- https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
- https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
- https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
- attack.execution
logsource:
product: linux
category: process_creation
detection:
selection:
ParentImage|startswith: /tmp/
Image|endswith:
- /bash
- /csh
- /dash
- /fish
- /ksh
- /sh
- /zsh
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2fade0b6-7423-4835-9d4f-335b39b83867
type: derived