Sigma rule: Program Executions in Suspicious Folders

Rule

Title

Program Executions in Suspicious Folders

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2018-01-23

Modified

2021-11-27

File

rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects program executions in suspicious non-program folders related to malware or hacking activity

Log source

product

linux

service

auditd

Detection

selection:
    type: 'SYSCALL'
    exe|startswith:
        # Temporary folder
        - '/tmp/'
        # Web server
        - '/var/www/'              # Standard
        - '/home/*/public_html/'   # Per-user
        - '/usr/local/apache2/'    # Classical Apache
        - '/usr/local/httpd/'      # Old SuSE Linux 6.* Apache
        - '/var/apache/'           # Solaris Apache
        - '/srv/www/'              # SuSE Linux 9.*
        - '/home/httpd/html/'      # Redhat 6 or older Apache
        - '/srv/http/'             # ArchLinux standard
        - '/usr/share/nginx/html/' # ArchLinux nginx
        # Data dirs of typically exploited services (incomplete list)
        - '/var/lib/pgsql/data/'
        - '/usr/local/mysql/data/'
        - '/var/lib/mysql/'
        - '/var/vsftpd/'
        - '/etc/bind/'
        - '/var/named/'
condition: selection

False positives (as the rule lists them)

• Admin activity (especially in /tmp folders)
• Crazy web applications

Tags

• attack.t1587
• attack.t1584
• attack.resource-development

MITRE ATT&CK ids this rule names

• T1584
• T1587

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml