Hidden Script Execution in /tmp (UAT-10608 / React2Shell)

Josh M.@jmadson

•updated Apr 2, 2026•15•1•195

This rule detects the execution of hidden shell scripts within the `/tmp/` directory on Linux systems, specifically looking for `nohup` commands that launch a shell (`sh` or `bash`) to execute a hidden `.sh` file (e.g., `.eba9ee1e4.sh`). This behavior is indicative of the UAT-10608 / React2Shell threat, often associated with credential harvesting operations.