Program Executions in Suspicious Folders (via auditd)

title: Program Executions in Suspicious Folders (via auditd)
id: 16488afa-11e6-56c1-9587-1bdca4f67074
status: stable
description: This rule detects program executions in anomalous non-program folders related to malware or hacking behavior
references:
    - https://attack.mitre.org/techniques/T1584/
    - https://attack.mitre.org/techniques/T1587/
    - Internal Research
author: Huntrule Team
date: 2026-02-23
tags:
    - attack.t1587
    - attack.t1584
    - attack.resource-development
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        exe|startswith:
            - '/tmp/'
            - '/var/www/'
            - '/home/*/public_html/'
            - '/usr/local/apache2/'
            - '/usr/local/httpd/'
            - '/var/apache/'
            - '/srv/www/'
            - '/home/httpd/html/'
            - '/srv/http/'
            - '/usr/share/nginx/html/'
            - '/var/lib/pgsql/data/'
            - '/usr/local/mysql/data/'
            - '/var/lib/mysql/'
            - '/var/vsftpd/'
            - '/etc/bind/'
            - '/var/named/'
    condition: selection
falsepositives:
    - Unknown
level: medium