Suspicious Linux C2 Activity: Network Connection Followed by File Creation

hello@craftedsignal.io — Fri, 03 Jul 2026 15:14:07 +0000

This threat brief describes a pattern of suspicious activity on Linux systems consistent with the operation of Command and Control (C2) agents like Poseidon or Athena. These agents often operate from non-standard, writable directories such as /tmp, /dev/shm, or /var/log to evade detection. The observed behavior involves such a process first initiating an outbound network connection, typically polling a C2 framework like Mythic for commands or new payloads. This network communication is then rapidly followed by the creation of a new file by the same process, usually in another suspicious location on the system. This file creation event often indicates the agent receiving and staging further instructions or malicious components. Defenders should recognize this two-stage sequence as a strong indicator of post-compromise activity, potentially leading to data exfiltration, lateral movement, or further system compromise.

Attack Chain

C2 Agent Deployment: An attacker successfully deploys a C2 agent (e.g., Poseidon, Athena) to a non-standard, writable location on a Linux host, such as /tmp, /dev/shm, /var/tmp, /var/log, /var/run/user, or /run/user.
Outbound C2 Connection: The deployed C2 agent initiates an outbound network connection (e.g., HTTP/S web requests) to its C2 server, potentially part of a C2 framework like Mythic, to poll for new commands or payloads.
Command Reception: The C2 server responds to the agent's poll, sending commands, scripts, or additional malicious binaries back to the compromised host.
Local File Creation: The C2 agent creates a new file on the local filesystem, often in a similar suspicious writable directory, to store the received commands, scripts, or payloads.
Command Execution: The C2 agent proceeds to execute the newly created file or the commands received, leading to further actions on objectives such as data collection, privilege escalation, or lateral movement.

Impact

Successful execution of such C2 agent activity can lead to a range of severe consequences. Attackers can maintain persistent access to the compromised Linux system, exfiltrate sensitive data, install additional malware, establish backdoors, or use the system as a launchpad for lateral movement within the network. Since this behavior is characteristic of established C2 frameworks, victims could face significant financial losses, reputational damage, and regulatory penalties depending on the type and sensitivity of compromised data. The lack of specifics in this detection means the full scope of impact can only be assessed upon incident response.

Recommendation

Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious network connections and file creations from writable directories.
Ensure comprehensive network_connection and file_event logging is enabled on all Linux endpoints to capture the necessary telemetry for these detections.
Implement correlation rules in your SIEM to link network connections from suspicious processes with subsequent file creations by the same process within a short timeframe, mimicking the original EQL rule's logic.
Regularly review processes executing from temporary or shared memory directories (/tmp, /dev/shm, /var/tmp) for anomalous network activity or file system modifications, as detected by the rules above.
Investigate all alerts generated by the Suspicious Process Network Connection from Writable Path on Linux rule, especially those involving connections to external or unusual IP addresses.
Analyze processes identified by the Suspicious File Creation by Process in Writable Path on Linux rule, focusing on the content of the created files and the parent process responsible.

Windows Credential Access from Browser Password Store Detection

hello@craftedsignal.io — Fri, 03 Jul 2026 13:11:48 +0000

Threat actors, often employing various Trojan Stealers such as SnakeKeylogger (mentioned in the source), frequently target web browser password stores and user profiles to extract sensitive information and credentials. This activity is a critical step in their data exfiltration strategy, enabling further compromise, financial fraud, or identity theft. The detection focuses on identifying processes that unexpectedly access browser user data directories on Windows systems. It specifically looks for instances where a process other than the legitimate browser application (e.g., chrome.exe accessing Chrome's user data) attempts to read or modify these sensitive files, indicating potential malicious activity. The methodology involves monitoring Windows Security Event Log 4663 for object access attempts and comparing the accessing process against a predefined list of allowed browser applications.

Attack Chain

Initial Access: The attacker gains initial access to the victim's system, commonly through phishing emails containing malicious attachments or links, or compromised websites leading to drive-by downloads.
Execution: The malicious payload, such as SnakeKeylogger, is executed on the victim's machine, often disguised as a legitimate application or document.
Discovery: The malware identifies the presence of installed web browsers and their respective user data directories, which store credentials, cookies, and other sensitive information.
Credential Access: The stealer malware initiates access to specific browser user data profiles and password stores (e.g., Login Data or key4.db files), attempting to read or decrypt stored credentials. This step often involves a non-browser process accessing these files.
Collection: Once accessed, the malware collects the harvested credentials, autofill data, cookies, and other valuable information from the browser's database files.
Exfiltration: The collected sensitive data is then encrypted and exfiltrated to the attacker's command and control (C2) server over various channels, typically HTTP/HTTPS.
Impact: The exfiltrated credentials are used for unauthorized access to online accounts, financial fraud, further network compromise, or sale on underground forums.

Impact

Successful exploitation results in significant data compromise, including user credentials, financial information, and personal data stored within web browsers. This can lead to unauthorized access to corporate and personal accounts, financial fraud, and identity theft. While the source does not provide specific victim counts, stealer malware campaigns are widespread and impact individuals and organizations across all sectors globally. The exfiltration of credentials can serve as a stepping stone for further lateral movement within an organization's network, escalating the initial compromise to a full-scale breach.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect suspicious browser credential access attempts by unauthorized processes.
Enable Windows Security Event Log 4663 by configuring "Audit Object Access" for both "Success" and "Failure" events in Group Policy.
Tune the browser_app_list lookup (or equivalent whitelist) within your detection system to accurately reflect legitimate browser applications and their expected access paths, reducing false positives.
Implement strong phishing awareness training for all users to reduce the likelihood of initial access by stealer malware.

Endpoint-Detection - CraftedSignal Threat Feed

Suspicious Linux C2 Activity: Network Connection Followed by File Creation

Attack Chain

Impact

Recommendation

Windows Credential Access from Browser Password Store Detection

Attack Chain

Impact

Recommendation