Linux File Immutable Attribute Modification via chattr
This detection identifies the use of the chattr command on Linux endpoints to add or remove the immutable (+i/-i) attribute on files. Threat actors abuse this technique to protect malicious files (such as persistence mechanisms or web shells) from modification or deletion, or to remove immutability from system files prior to tampering. Investigate the parent process, executing user, and target file path to determine whether the activity aligns with legitimate administrative work or indicates anti-forensics or persistence behavior.
CQL
