Suspicious Linux Process Execution From /tmp Directory

Flags execution of binaries located under /tmp on Linux, excluding a known Nextcloud path.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-06-02
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creations where the process image path starts with /tmp/, indicating the executable was launched from a temporary directory. Attackers often use /tmp to run dropped payloads or execute tools that avoid well-known install locations. The detection relies on Linux process creation telemetry that includes the executed image path.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Suspicious GitHub Actions Runner In Hidden Directory via Shell (via process_creation)

Suspicious Billbug Loader Artifacts in Windows Temp Directory

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)

Suspicious Rename of Double-Extension PowerShell Script (via process_creation)

Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic

Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus

Suspicious Linux Process Execution From /tmp Directory

Pivot detection · T1036 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-linux-process-execution-from-tmp-directory-312b42b1

title: Suspicious Linux Process Execution From /tmp Directory
id: 0151ae52-029c-45dc-bdd0-42e537abac3d
status: test
description: This rule flags Linux process creations where the process image path starts with /tmp/, indicating the executable was launched from a temporary directory. Attackers often use /tmp to run dropped payloads or execute tools that avoid well-known install locations. The detection relies on Linux process creation telemetry that includes the executed image path.
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
modified: 2025-08-05
tags:
  - attack.stealth
  - attack.t1036
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|startswith: /tmp/
  filter_optional_nextcloud:
    Image|endswith: /usr/bin/nextcloud
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 312b42b1-bded-4441-8b58-163a3af58775
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL