Linux Touch Command Modifying Service File Timestamps
This rule detects the use of the 'touch' command to modify the timestamps of service files. Adversaries may use this technique to make malicious service files appear legitimate or to evade detection by blending them with existing system files. The detection specifically looks for the 'touch' command being executed with the '-t' flag (to set a specific time) and targeting a file ending with '.service'.
Sigma
