cscli scenarios install crowdsecurity/auditd-sus-execAttempt to detect a binary that is executed from unusual / suspicious locations, such as /tmp/ or hidden directories startimg with a ..
This pattern is usually seen in post-exploitation when attackers are attempting to hide backdoors and other tools.
1type: trigger2#debug: true3name: crowdsecurity/auditd-sus-exec4description: "Detect post-exploitation behaviour : exec from suspicious locations"5filter: evt.Meta.log_type == 'execve' and ( evt.Meta.exe startsWith "/tmp/" or evt.Meta.exe contains "/." )6labels:7 confidence: 28 spoofable: 09 classification:10 - attack.T1059.00411 behavior: "linux:post-exploitation"12 label: "Post Exploitation command execution"13 service: linux14 remediation: false15scope:16 type: pid17 expression: evt.Meta.ppid18