Linux chmod +x then execution of hidden file from world-writable

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects a suspicious sequence on Linux systems where executable permissions are added to a file located in a world-writable directory (/tmp, /var/tmp, /dev/shm), followed by the execution of that same dropped or hidden file, optionally followed by cron persistence within a specified timeframe.