How do you detect suspicious execution from the /tmp directory on Linux?

What makes /tmp execution suspicious on Linux?

Execution from /tmp is suspicious because that directory is typically writable and transient, so it is a common place for dropped payloads, staging files, and short-lived scripts. The signal is strongest when the file was created moments before execution, has a random or misleading name, or was launched by a process that would not normally use /tmp for code.

Good detection logic treats /tmp as a context signal, not a verdict by itself. Legitimate software can use temporary storage, so the key is to combine pathname, freshness, file type, parent process, user context, and privilege level before you decide whether the event is benign or malicious.

Which execution patterns deserve the most attention?

The highest-value detections focus on binaries, shell scripts, or interpreted payloads started directly from /tmp, especially when the file appears shortly before process start or has execute permissions added immediately beforehand. That pattern often indicates download-and-run tradecraft, archive extraction, or a staged dropper rather than normal application behaviour. Correlation with command lines, child processes, and network activity helps separate one-off admin work from an intrusion path.

Also watch for execution paths that blend in through symbolic links, copied filenames, or renamed files under temporary directories. Attackers often try to make the process tree look ordinary, so a useful rule looks beyond the pathname alone and asks whether the parent process, user session, and execution timing make sense for the host.

How should you reduce false positives while keeping coverage high?

Start by baselining the hosts and user groups that legitimately execute from temporary locations, then carve out those known behaviours before you turn on broad alerting. On Linux, there is a practical difference between a developer workstation, a build system, and a production server, so the same /tmp execution event may carry very different meaning depending on the asset role.

For stronger triage, check whether the file was created by a downloader, archive utility, browser, or scripting interpreter; whether it was made executable; and whether it immediately spawned a network connection or credential-access activity. Those relationships are more informative than filename patterns alone, and they help distinguish a temporary helper script from a staged payload.

Risk and Threat Considerations

Linux Detection and Response Guide is useful here because /tmp execution is a classic telemetry problem in Linux detection and response, not just a file-path heuristic. Suspicious execution often signals a dropped payload, privilege abuse, or a short-lived foothold that can disappear before manual review.

Failure mechanism: An attacker writes code to a writable temporary directory, flips permissions, and launches it before defenders notice. Because /tmp is noisy and expected to change frequently, weak monitoring can miss the chain from download to execution to follow-on activity.

Impact: Missed detection can let malware establish persistence, spawn lateral movement, or run with elevated privileges or under a service account that broadens blast radius. The consequence is not just execution in a temporary directory, but faster compromise progression and weaker forensic visibility.

Practitioner Guidance

What to verify: Confirm whether the executable was newly created, whether execute bits changed immediately before launch, and whether the parent process makes sense for the host role. A good alert is one that ties file creation, permission change, and process start into a single story rather than treating each event separately.

Decision rule: If the process launched from /tmp is running as root, a privileged admin account, or an unusual service account, treat it as materially higher risk and escalate faster. That combination changes the question from “odd location” to “potentially high-impact code execution path.”

Practitioner takeaway: The most reliable detections combine ephemeral-file behaviour with execution context, because /tmp alone is only a weak signal, but /tmp plus fresh creation, permission change, and abnormal privilege is a strong compromise indicator.

Related resources from NHI Mgmt Group

• How do you detect hacking tool execution on Linux?
• How do you patch or mitigate CVE-2010-1871 (Red Hat Linux JBoss Seam 2 Remote Code Execution)?
• How do you detect a new domain trust being created in Active Directory?
• How do you detect Active Directory enumeration using PowerShell cmdlets?