Chmod to Suspicious Directory

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•24

Detects the use of the 'chmod' command to modify file permissions in suspicious directory paths commonly used by malware for persistence or evasion. This rule specifically looks for chmod operations within '/tmp/', '/.Library/', '/etc/', and '/opt/' directories.