Techniques › T1204.002 › AN0821
AN0821 Analytic 0821
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.</p>
- Detects
- T1204.002 Malicious File
- Part of
- DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions | DC0039 File Creation |
| auditd:SYSCALL | execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window for audit events (e.g., ≤5m). |
DesktopParentMap | Map common desktop apps (libreoffice, evince, firefox, chromium) for lineage anchoring. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2007-5659 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-0655 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-2992 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-1862 | Adobe Acrobat and Reader, Flash Player | Mapped |
| CVE-2009-3953 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-4324 | Adobe Acrobat and Reader | Mapped |
| CVE-2010-1297 | Adobe Flash Player | Mapped |
| CVE-2010-2883 | Adobe Acrobat and Reader | Mapped |
| CVE-2011-0611 | Adobe Flash Player | Mapped |
| CVE-2011-2462 | Adobe Reader and Acrobat | Mapped |
| CVE-2012-0754 | Adobe Flash Player | Mapped |
| CVE-2012-1535 | Adobe Flash Player | Mapped |
| CVE-2013-0641 | Adobe Reader | Mapped |
| CVE-2014-0496 | Adobe Reader and Acrobat | Mapped |
| CVE-2015-3043 | Adobe Flash Player | Mapped |
| CVE-2015-3113 | Adobe Flash Player | Mapped |
| CVE-2015-7645 | Adobe Flash Player | Mapped |
| CVE-2016-0984 | Adobe Flash Player and AIR | Mapped |
| CVE-2016-4117 | Adobe Flash Player | Mapped |
| CVE-2017-11292 | Adobe Flash Player | Mapped |
| CVE-2018-15982 | Adobe Flash Player | Mapped |
| CVE-2018-4878 | Adobe Flash Player | Mapped |
| CVE-2018-4990 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-21017 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-28550 | Adobe Acrobat and Reader | Mapped |
| CVE-2022-30190 | Microsoft Windows | Mapped |
| CVE-2022-34713 | Microsoft Windows | Mapped |
| CVE-2023-21608 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-21715 | Microsoft Office | Mapped |
| CVE-2023-26369 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-36884 | Microsoft Windows | Stale |
| CVE-2024-38080 | Microsoft Windows | Mapped |
| CVE-2025-27363 | FreeType FreeType | Mapped |