Program Executions in Suspicious Folders

Title: Program Executions in Suspicious Folders
Status: test
Description:Detects program executions in suspicious non-program folders related to malware or hacking activity
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2018-01-23
modified:2021-11-27
Tags:

• -'attack.t1587'
• -'attack.t1584'
• -'attack.resource-development'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'SYSCALL'
    exe|startswith:
      -'/tmp/'
      -'/var/www/'
      -'/home/*/public_html/'
      -'/usr/local/apache2/'
      -'/usr/local/httpd/'
      -'/var/apache/'
      -'/srv/www/'
      -'/home/httpd/html/'
      -'/srv/http/'
      -'/usr/share/nginx/html/'
      -'/var/lib/pgsql/data/'
      -'/usr/local/mysql/data/'
      -'/var/lib/mysql/'
      -'/var/vsftpd/'
      -'/etc/bind/'
      -'/var/named/'

  condition:selection
Falsepositives:
  -Admin activity (especially in /tmp folders)
  -Crazy web applications
Level: medium