T1055/T1620: Rust Loader decrypt_shellcode_stub Execution from /tmp

Tim Peck@timpeck

•updated Jul 21, 2026•14•0•26

This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.