Linux File Permissions Changed to Hide Malware

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.