Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
27
22
8
5
3
Contributors
20
11
10
7
5
Categories
50
43
36
16
8
Platforms
60
15
5
2
1
Products / Services
32
14
10
9
8
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
2
The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes.
The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
Detects the use of the 'chmod' command to modify file permissions in suspicious directory paths commonly used by malware for persistence or evasion. This rule specifically looks for chmod operations within '/tmp/', '/.Library/', '/etc/', and '/opt/' directories.
This rule detects attempts to change file or folder permissions and ownership on Linux systems by monitoring the execution of the 'chmod' and 'chown' commands. These commands are commonly used by adversaries to modify access controls, potentially to evade defenses, gain access to protected files, or establish persistence.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Page 4 of 4