Write-Then-Execute Script in Temporary Directory

How the attack works

An AI agent with file-write and command-execution tools first writes a script to a world-writable temporary directory like /tmp. It then either calls the same tool or shells out to execute that file. The detection watches both the write step and the later execution step, confirming the executed file matches a path the agent itself just created, which distinguishes this from unrelated scripts already sitting in /tmp.

Netzilo detection

Why it matters

An attacker who can influence an agent's tool calls can use this pattern to stage and run arbitrary code, bypassing controls that assume executable code lives in trusted, version-controlled locations. Because temp directories are cleaned automatically, the payload can also disappear on its own, making forensic follow-up harder.

What you can do

• →Mount /tmp, /var/tmp, and /dev/shm with noexec where your workloads allow it, so scripts placed there cannot be run directly.
• →Restrict which directories an AI agent's execution tools are allowed to run files from, and reject execution requests targeting temp paths.
• →Log and review write-then-execute sequences in agent tool call history, especially where the executed path was created moments earlier.
• →When investigating alerts, check whether the activity matches known CI/CD or package-manager behavior before treating it as suspicious, since these legitimately use temp directories this way.

Known benign look-alikes

• Build systems that compile and execute test scripts in /tmp during CI/CD pipelines
• Package managers that extract and run post-install scripts from temporary directories

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1027/

Related threats