ZiChatBot Linux obs-check-update Stage Executes from obsHub

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•2

Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable. This rule specifically looks for process creation events where the executable name is 'obs-check-update' and the file path is within '/tmp/obsHub/' or '/var/tmp/obsHub/'.