Chattr Used to Make File Immutable on Linux
This rule detects the use of the 'chattr +i' command over a network connection to port 22 (SSH). The 'chattr +i' command on Linux is used to make a file immutable, meaning it cannot be modified, deleted, or renamed, even by the root user. This behavior can be indicative of an attacker attempting to prevent forensic analysis or hinder system recovery by protecting their malicious files or modifying critical system files.
Suricata
