chmod +x and direct execution of /tmp/helper payload

Emiliano Mema@Nosalva

•updated Aug 26, 2026•5•0•8

Detects the execution of the 'chmod +x' command to mark a file named '/tmp/helper' as executable, followed by the execution of that same binary within a 5-minute window. This behavior is indicative of an attacker dropping and executing a payload from a temporary directory.