Remove Immutable File Attribute via chattr
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Sigma
