Detectionmediumtest

Remove Immutable File Attribute

Detects usage of the 'chattr' utility to remove immutable file attribute.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Thu Sep 1534979410-e4b5-4e5d-8cfb-389fdff05c12linux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/chattr'
        CommandLine|contains: ' -i '
    condition: selection

False Positives

Administrator interacting with immutable files (e.g. for instance backups).

References

MITRE ATT&CK

Tactics

Other

attack.t1222.002

Related Rules

Remove Immutable File Attribute - Auditd

Detects removing immutable file attribute.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

34979410-e4b5-4e5d-8cfb-389fdff05c12

Status

test

Level

medium

Type

Detection

Created

Thu Sep 15

Author

Path

rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml

Raw Tags

attack.defense-evasionattack.t1222.002