{"id":"a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc","title":"Program Executions in Suspicious Folders","description":"Detects program executions in suspicious non-program folders related to malware or hacking activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-01-23","modified":"2021-11-27","tags":["attack.t1587","attack.t1584","attack.resource-development"],"technique_ids":["T1584","T1587"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Admin activity (especially in /tmp folders)","Crazy web applications"],"references":["Internal Research"],"source_path":"rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml","source_sha256":"39e008caa81f11bab0110693e885e05ef1089e776786b6abb5e16f8ada71dfcc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Program Executions in Suspicious Folders\nid: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc\nstatus: test\ndescription: Detects program executions in suspicious non-program folders related to malware or hacking activity\nreferences:\n    - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-01-23\nmodified: 2021-11-27\ntags:\n    - attack.t1587\n    - attack.t1584\n    - attack.resource-development\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection:\n        type: 'SYSCALL'\n        exe|startswith:\n            # Temporary folder\n            - '/tmp/'\n            # Web server\n            - '/var/www/'              # Standard\n            - '/home/*/public_html/'   # Per-user\n            - '/usr/local/apache2/'    # Classical Apache\n            - '/usr/local/httpd/'      # Old SuSE Linux 6.* Apache\n            - '/var/apache/'           # Solaris Apache\n            - '/srv/www/'              # SuSE Linux 9.*\n            - '/home/httpd/html/'      # Redhat 6 or older Apache\n            - '/srv/http/'             # ArchLinux standard\n            - '/usr/share/nginx/html/' # ArchLinux nginx\n            # Data dirs of typically exploited services (incomplete list)\n            - '/var/lib/pgsql/data/'\n            - '/usr/local/mysql/data/'\n            - '/var/lib/mysql/'\n            - '/var/vsftpd/'\n            - '/etc/bind/'\n            - '/var/named/'\n    condition: selection\nfalsepositives:\n    - Admin activity (especially in /tmp folders)\n    - Crazy web applications\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","page":"techniques/enterprise/T1584/"},{"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","page":"techniques/enterprise/T1587/"}],"data_path":"data/detection-rules/a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc.json","kind":"sigma"}