Linux File or Folder Permissions Change via Chmod/Chown
This rule detects attempts to change file or folder permissions and ownership on Linux systems by monitoring the execution of the 'chmod' and 'chown' commands. These commands are commonly used by adversaries to modify access controls, potentially to evade defenses, gain access to protected files, or establish persistence.
Sigma
