Permission changes on Acronis cPanel/WHM/Plesk backup plugin files
Detects the use of chmod, chown, or chattr to modify file permissions on paths related to backup (Acronis) or hosting management (cPanel, WHM, Plesk) software. Specifically monitors for command-line arguments indicating a change to world-writable permissions (e.g., 777, o+w, a+rwx) on sensitive configuration files.
Microsoft Sentinel (KQL)
