BambooToken Linux backdoor shell spawn + file activity

Ankit Mehta@Secvyn

•updated Sep 15, 2026•3•0•4

This rule detects shell processes (sh or bash) being spawned from suspicious, commonly writable directories (e.g., /tmp, /dev/shm) within a short window of file system activity (creation, modification, or deletion) and associated MQTT protocol network communication. This pattern is indicative of potential malware staging or command-and-control activity on Linux systems.