Suspicious Execution from /tmp/pglog

Tim Peck@timpeck

•updated Mar 20, 2026•5•1•109

Detects the execution of a binary from the path /tmp/pglog, which is used as a dropper location by the malicious sysmon.py script associated with the TeamPCP Trivy supply chain malware.