Suspicious process execution from tmp folder

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Hide Artifacts: Hidden Files and Directories (T1564.001)
Severity	Informational

Description

An unpopular process was executed from the tmp folder.

Attacker's Goals

Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions

Verify that this isn't IT activity.
Look for other hosts executing similar commands.

Variations

A web server process executed an unpopular application from the tmp folder

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Hide Artifacts: Hidden Files and Directories (T1564.001)
Severity	Medium

Description

An executable application ran from the tmp folder by a web server process.

Attacker's Goals

Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions

Verify that this isn't IT activity.
Look for other hosts executing similar commands.

Suspicious cron job task execution of a binary from the tmp folder

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Hide Artifacts: Hidden Files and Directories (T1564.001)
Severity	Medium

Description

An unpopular process was executed from the tmp folder.

Attacker's Goals

Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions

Verify that this isn't IT activity.
Look for other hosts executing similar commands.

Suspicious interactive execution of a binary from the tmp folder

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Hide Artifacts: Hidden Files and Directories (T1564.001)
Severity	Medium

Description

An unpopular process was executed from the tmp folder.

Attacker's Goals

Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions

Verify that this isn't IT activity.
Look for other hosts executing similar commands.

Suspicious process execution from tmp folder in a Kubernetes pod

Synopsis

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Hide Artifacts: Hidden Files and Directories (T1564.001)
Severity	Informational

Description

An unpopular process was executed from the tmp folder.

Attacker's Goals

Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions

Verify that this isn't IT activity.
Look for other hosts executing similar commands.