Program Executions in Suspicious Folders
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
Sigma
