Script Execution from /tmp Directory

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•2

Detects the execution of bash, python, or node scripts originating from the /tmp directory. This is a common staging location for malicious droppers and scripts.