Overly Permissive File Permissions via chmod 777

Jorden Smith@Jorden

•updated Feb 10, 2026•1•0•21

This rule detects the use of the 'chmod' command to set overly permissive file permissions, specifically '777' (read, write, and execute for all users) in either octal or symbolic notation. It looks for 'chmod' as the executed command and then checks its arguments for '777', '0777', 'a=rwx', 'ugo+rwx', or 'a+rwx'. This activity can indicate a misconfiguration, a security vulnerability being introduced, or an attempt to bypass security controls.