IoT Botnet /tmp Staging with chmod 777 and Immediate File Deletion

Ethan Andrews@eandrews

•updated Jun 25, 2026•0•0•1

Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.