Suspicious Process Execution from /tmp/ Directory
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Sigma
