Suspicious Linux Process Execution from /tmp Directory

title: Suspicious Linux Process Execution from /tmp Directory
id: 0151ae52-029c-45dc-bdd0-42e537abac3d
status: test
description: This rule flags Linux process executions where the executable path starts with "/tmp/", a common location for transient files used by malware loaders and droppers. Attackers often place binaries or scripts in world-writable directories like /tmp to evade simple install-time controls and quickly execute payloads. Detection relies on process creation telemetry that includes the process image path, and it suppresses matches for a specific benign Nextcloud binary located at "/usr/bin/nextcloud".
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
modified: 2025-08-05
tags:
  - attack.stealth
  - attack.t1036
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|startswith: /tmp/
  filter_optional_nextcloud:
    Image|endswith: /usr/bin/nextcloud
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 312b42b1-bded-4441-8b58-163a3af58775
    type: derived