Suspicious Shell from /var/tmp/ Executable

Ethan Andrews@eandrews

•updated Feb 25, 2026•7•0•68

Detects a process with a short, alphanumeric filename executing from the /var/tmp/ directory and spawning a shell. This behavior is associated with the GRIDTIDE backdoor, which uses this technique for post-compromise reconnaissance and execution.