Writable And Executable Directory Probe

medium Single event T1059.004 T1083 Discovery, Execution

The bot creates an empty dot-file in a directory and runs it with sh, for example `echo > /dev/shm/.b && sh /dev/shm/.b`. It repeats this across /tmp, /var/run, /dev/shm and others to find a directory that is both writable and not mounted noexec, then drops its payload there.

Tested

Matches all 2 attack events in match.jsonl and none of the 3 look-alike events in nomatch.jsonl. See the test events.

False positives

Unlikely; legitimate scripts do not test directories this way

Sigma

title: Writable And Executable Directory Probe
id: 92b9d317-840c-40f1-b833-19392ae8a98d
status: experimental
description: |
  The bot creates an empty dot-file in a directory and runs it with sh, for example
  `echo > /dev/shm/.b && sh /dev/shm/.b`. It repeats this across /tmp, /var/run, /dev/shm and others to
  find a directory that is both writable and not mounted noexec, then drops its payload there.
references:
  - https://attack.mitre.org/techniques/T1083/
author: Estul Lachin
date: 2026-11-08
tags:
  - attack.discovery
  - attack.t1083
  - attack.execution
  - attack.t1059.004
logsource:
  product: cowrie
detection:
  selection:
    eventid: cowrie.command.input
    input|re: 'echo\s*>\s*\S+/\.\w+\s*&&\s*sh\s+\S+/\.\w+'
  condition: selection
falsepositives:
  - Unlikely; legitimate scripts do not test directories this way
level: medium

rules/writable_dir_probe.yml

Splunk SPL

``` Writable And Executable Directory Probe. Generated from rules/writable_dir_probe.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input"
| regex input="echo\\s*>\\s*\\S+/\\.\\w+\\s*&&\\s*sh\\s+\\S+/\\.\\w+"

Verified in Splunk against the test events. dist/spl/writable_dir_probe.spl

Microsoft Sentinel KQL

// Writable And Executable Directory Probe. Generated from rules/writable_dir_probe.yml by tools/build.py; do not edit.
Cowrie_CL
| where eventid =~ "cowrie.command.input" and input matches regex "echo\\s*>\\s*\\S+/\\.\\w+\\s*&&\\s*sh\\s+\\S+/\\.\\w+"

For a custom table Cowrie_CL with Cowrie's field names. Converted, not yet run in Sentinel. dist/kql/writable_dir_probe.kql