Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
/filesystems/tmp_fs on /tmp type ext3 (rw,nosuid,noexec,relatime,data=ordered) disabling such executions can break systems and certain environments so monitoring makes the most sense. Lets create a rule using the following to check for such executions. What we want to see is the filepath /tmp/