7f/90/7f90ab26c243b39d46fe865f8e1091a9fe73b23cc8f4aabc132f993527c86726
Hidden path prefix in /tmpTop-level traits or composite_rules key
SHA-2567f90ab26c243b39d46fe865f8e1091a9fe73b23cc8f4aabc132f993527c86726
MaleculeH(F)Md
Evidence
1defaults:
2 platforms: [linux, macos]
3 for: [elf, macho, go, shell, python, javascript, typescript]
4traits:
5# A hardcoded hidden dotfile under /tmp is a stealth artifact: malware stashes
6# run-once/state markers (e.g. `/tmp/.base58_detection_sent`, checked to avoid
7# re-exfiltrating) and small payloads there so casual `ls /tmp` misses them.
8# Kept notable; the benign desktop-socket/lock family (.X11-unix, .ICE-unix,
9# .font-unix, .XIM-unix, X server locks) is carved out so it stays clean.
10- id: hidden-tmp-state-file
11 desc: Hidden dotfile stashed in /tmp
12 crit: notable
13 conf: 0.8
14 if:
⋯7 lines
22 - regex: '/tmp/\.(pulse|esd|com\.apple)' # audio / macOS system sockets
23 # Hidden mktemp/PID temp directories are working directories, not stashed
24 # state files; keep literal hidden dotfiles such as /tmp/.foo_sent covered.
25 - regex: '/tmp/\.[A-Za-z0-9][A-Za-z0-9._-]{1,64}\.X{3,}'
26 - regex: '/tmp/\.[A-Za-z0-9][A-Za-z0-9._-]{1,64}\$\$'
27 - substr: '.curl'
28 - substr: '/tmp/.gocache'
29 - substr: '/tmp/.noeta-tavily-'
30 - substr: '/tmp/.homebrew_pkg_user'
31 unless:
32 - id: metadata/lang/upstream::linux-kernel-primary-tree-path
⋯9 lines