Techniques › T1204 › AN1315
AN1315 Analytic 1315
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Cause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.</p>
- Detects
- T1204 User Execution
- Part of
- DET0478 User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| linux:syslog | opened document|clicked link|segfault|abnormal termination|sandbox | DC0038 Application Log Content |
| auditd:SYSCALL | open | DC0055 File Access |
| auditd:SYSCALL | creat | DC0039 File Creation |
| auditd:SYSCALL | rename,chmod | DC0061 File Modification |
| auditd:SYSCALL | execve | DC0032 Process Creation |
| NSM:Flow | new outbound connection from browser/office lineage | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | 5–20 minute correlation window. |
UserPaths | $HOME/Downloads, /tmp, ~/.cache, ~/.config/autostart, ~/.local/share. |
HighRiskChildren | bash, sh, zsh, python*, perl, node, curl, wget, xdg-open, kde-open, gio open, unzip/tar extraction leading to exec. |
PkgUpdaters | Allow-list snap/flatpak/packagekit/apt workers to reduce false positives. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2023-38831 | RARLAB WinRAR | Mapped |
| CVE-2025-24993 | Microsoft Windows | Mapped |