Timestomping via touch -r / chmod --reference on runit etc/sv files (KeyDrift)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects the use of touch, chmod, or chown commands targeting paths containing 'etc/sv/' where reference-based timestamp or permission copying is performed, typically associated with timestomping or privilege/permission manipulation.