Detectionmediumtest

Remove Immutable File Attribute - Auditd

Detects removing immutable file attribute.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Jakob Weinzettl, oscd.communityCreated Mon Sep 23Updated Sat Nov 26a5b977d6-8a81-4475-91b9-49dbfcd941f7linux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Detection Logic

detection:
    selection:
        type: 'EXECVE'
        a0|contains: 'chattr'
        a1|contains: '-i'
    condition: selection

False Positives

Administrator interacting with immutable files (e.g. for instance backups).

References

Testing & Validation

Simulations

atomic-red-teamT1222.002

Remove immutable file attribute

GUID: e7469fe2-ad41-4382-8965-99b94dd3c13f

MITRE ATT&CK

Tactics

Other

attack.t1222.002

Rule Metadata

Rule ID

a5b977d6-8a81-4475-91b9-49dbfcd941f7

Status

test

Level

medium

Type

Detection

Created

Mon Sep 23

Modified

Sat Nov 26

Author

Path

rules/linux/auditd/execve/lnx_auditd_chattr_immutable_removal.yml

Raw Tags

attack.defense-evasionattack.t1222.002