Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
18
12
6
4
4
Contributors
8
8
6
5
5
Categories
21
21
13
13
11
Platforms
31
12
1
1
1
Products / Services
11
10
6
6
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
This rule detects the use of the 'find' command on Linux systems with specific permission-related arguments. These arguments are often used by attackers during the discovery phase to locate files with unusual permissions, such as SUID/SGID binaries (-perm -4000, -perm -2000, -perm -u=s, -perm -g=s) which can be exploited for privilege escalation, or world-writable files (-perm 0777, -perm -222, -perm -o w) which could be used for persistence or data modification. It also looks for world-executable files (-perm -o x).
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity is suspicious as it can be used by adversaries to gain persistence, elevate privileges, or evade defenses by modifying critical system file permissions.
Page 3 of 3