Centrify Linux Monitored File Modified
Detects modification of a monitored file on a Centrify-managed Linux host. File integrity events on Unix servers catch tampering with configuration, authorised keys and service definitions — the common Linux persistence routes, which leave no registry trace and no Windows-style artefact. Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='FILE_MODIFIED' | groupby user, targetuser, domain
Sigma
