Critical Files Modified on Network Share
This rule detects attempts to modify the end-of-file marker on a network share, specifically looking for the 'SetEndOfFile' operation over SMB. This activity can be indicative of an attacker manipulating file sizes or content on shared resources, potentially as part of data staging or to evade detection. The rule is configured with a threshold to alert on 20 such events from the same source within 30 seconds, aiming to reduce noise from legitimate, infrequent operations.
Suricata
