Staged file write in /tmp read via cat shortly after (C2 exfil pattern)

Ethan Andrews@eandrews

•updated Aug 17, 2026•2•0•5

This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.