Suspicious /tmp Permission Modification (Masjesu Botnet)

Elgonad .@elgonad

•updated Apr 14, 2026•2•0•253

Detects attempts to modify the permissions of the /tmp directory to read-only (CHMOD 400), a tactic used by the Masjesu botnet to prevent rival malware from writing to shared temporary space.