Linux Shared-Writable Staging to Execution (Land and Run)

title: Writable-Directory Stage-and-Execute - Payload Staging in Temp Directories (Research)
id: 34c48548-c78a-4325-bf2a-9d7e359fc1dc
status: experimental
description: >
  Detects file creation in common payload staging directories on Linux hosts.
  Research level — high false positive rate from system activity. Use for
  baselining what normally writes to these paths before tuning. Lab-validated
  2026-09-28: seven current delivery methods (scp, heredoc, base64, echo pipe,
  python write, C2 upload, lateral scp) generated file_land events on Debian 12
  and Rocky 9 targets. 26 file_land events on deb12, 30 on rocky9. The revised
  T08 cron-spool write succeeded at script level on 2026-10-04 but has no
  auditd file_land receipt, so it is not telemetry-validated. System noise is
  significant — dracut, systemd-private, package managers — and must be
  baselined before hunting.
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
  - https://www.zscaler.com/blogs/cybersecurity-best-practices/rocke-cryptominer
  - https://github.com/iimp0ster/detection-chokepoints
author: "Jenna Frank (co-conspirator: SancLogic)"
date: 2026-09-28
modified: 2026-10-04
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection
falsepositives:
  - System package managers writing temp files
  - systemd-private tmp directory activity
  - Application update mechanisms
level: informational

title: Writable-Directory Stage-and-Execute - Process Execution from Staging Directory (Hunt)
id: d5a6c3ad-48e6-4fb2-bf1d-109a7900213a
status: experimental
description: >
  Detects process execution involving a staging directory, covering two
  paths. Direct: the binary itself lives under /tmp, /dev/shm, or /var/tmp.
  Interpreter: a shell or scripting interpreter consumes a file from a
  staging directory (visible in CommandLine). Excludes known system paths
  to reduce noise. Hunt level — medium false positive rate. Lab-validated
  2026-09-28. Direct path caught T02 chmod+exec and Sliver /tmp/.update.
  Interpreter path caught T01 bash, T03 heredoc, T04 base64, T06 python3.
  Field-grounded: C0XMO direct execution of /tmp/.cache would match
  selection_direct.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
  - https://www.zscaler.com/blogs/cybersecurity-best-practices/rocke-cryptominer
  - https://github.com/iimp0ster/detection-chokepoints
author: "Jenna Frank (co-conspirator: SancLogic)"
date: 2026-09-28
modified: 2026-10-04
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection_direct:
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_interpreter:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/python'
      - '/perl'
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  filter_main_system:
    Image|contains:
      - 'systemd-private'
      - 'dracut'
      - 'initramfs'
  filter_main_interpreter_system:
    CommandLine|contains:
      - 'systemd-private'
      - 'dracut'
      - 'initramfs'
  condition: (selection_direct and not filter_main_system) or (selection_interpreter and not filter_main_interpreter_system)
falsepositives:
  - Legitimate admin scripts stored in /tmp during maintenance
  - Configuration management tools (Ansible, Puppet) staging in /tmp
  - Package manager post-install scripts referencing /tmp
level: medium

title: Writable-Directory Stage-and-Execute - Hidden File Execution from Staging Directory (Analyst)
id: 05b1a367-d439-4914-bcc9-add33c7b7e2e
status: experimental
description: >
  Detects execution of hidden (dot-prefixed) files from staging directories,
  covering direct execution (binary at /tmp/.) and interpreter consumption
  (bash /tmp/.x visible in CommandLine). Also catches cron-launched execution
  from staging paths. Analyst level — low false positive rate, SOC-deployable.
  Hidden files in /tmp and /dev/shm are a strong indicator of attacker staging;
  legitimate software rarely uses this pattern. Lab-validated 2026-09-28:
  Sliver /tmp/.update, /dev/shm/.cache, /dev/shm/.payload all matched.
  Field-grounded: C0XMO /tmp/.cache would match selection_hidden_direct.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1105/
  - https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
  - https://www.zscaler.com/blogs/cybersecurity-best-practices/rocke-cryptominer
  - https://attack.mitre.org/techniques/T1564/001/
  - https://github.com/iimp0ster/detection-chokepoints
author: "Jenna Frank (co-conspirator: SancLogic)"
date: 2026-09-28
modified: 2026-10-05
tags:
  - attack.execution
  - attack.t1059.004
  - attack.stealth
  - attack.t1564.001
logsource:
  product: linux
  category: process_creation
detection:
  selection_hidden_direct:
    Image|startswith:
      - '/tmp/.'
      - '/dev/shm/.'
      - '/var/tmp/.'
  selection_hidden_interpreter:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/python'
      - '/perl'
    CommandLine|contains:
      - '/tmp/.'
      - '/dev/shm/.'
      - '/var/tmp/.'
  selection_cron_from_staging:
    ParentImage|endswith:
      - '/cron'
      - '/crond'
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_hidden_direct or selection_hidden_interpreter or selection_cron_from_staging
falsepositives:
  - Legitimate hidden temp files from build systems (rare in /tmp)
level: high