# Uncommon Process Execution from Suspicious Directory

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies uncommon process executions from suspicious directories on Linux systems. It looks for processes executed from directories that are often associated with malicious activity, such as /dev/shm, /var/www, /boot, /srv, /tmp, /var/tmp, /run, and /var/run. The goal is to detect potentially malicious processes while excluding common, benign ones.

- **UUID:** `0ea47044-b161-4785-ba99-e11f46d6ac51`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Uncommon Process Execution from Suspicious Directory](../queries/execution_uncommon_process_execution_from_suspicious_directory.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
// Add paths to monitor from your environment here
  process.executable like "/dev/shm/*" or
  process.executable like "/var/www/*" or
  process.executable like "/boot/*" or
  process.executable like "/srv/*" or
  process.executable rlike "/tmp/[^/]+" or
  process.executable rlike "/var/tmp/[^/]+" or
  process.executable rlike "/run/[^/]+" or
  process.executable rlike "/var/run/[^/]+"
) and not (
  // Exclude noisy (parent) processes, users or directories from your environment here
  process.parent.executable in ("/usr/sbin/dpkg-preconfigure") or
  // Exclude /tmp and /var/tmp instances starting or ending with digits (usually benign files)
  process.executable rlike "/tmp/[0-9].*" or
  process.executable rlike "/tmp/.*[0-9]/?" or
  process.executable rlike "/var/tmp/[0-9].*" or
  process.executable rlike "/var/tmp/.*[0-9]/?"
)
| stats cc = count(), host_count = count_distinct(host.name) by process.executable, process.parent.executable
// Alter this threshold to make sense for your environment
| where cc <= 3 and host_count <= 3
| sort cc asc
| limit 100
```

## Notes

- Excluded /tmp, /var/tmp, /run, /var/run subdirectories to reduce noise.
- Excluded /tmp, /var/tmp files starting or ending with digits to exclude real temporary files.
- Included a process or parent process count of <= 3, and a host count of <= 3 to eliminate common processes across different hosts.

## MITRE ATT&CK Techniques

- [T1036.004](https://attack.mitre.org/techniques/T1036/004)
- [T1049](https://attack.mitre.org/techniques/T1049)
- [T1059](https://attack.mitre.org/techniques/T1059)
- [T1059.004](https://attack.mitre.org/techniques/T1059/004)

## License

- `Elastic License v2`
