Linux auditd: chmod and chown executions indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

FreeUnreviewedSigmalowv1

linux-auditd-chmod-and-chown-executions-indicating-file-or-folder-permission-cha-74c01ace

title: "Linux auditd: chmod and chown executions indicating file or folder permission changes"
id: edcac7f3-4eb8-4dcc-a588-1d80d1044187
status: test
description: This rule identifies executions of chmod and chown by matching auditd records for EXECVE events containing those commands. Changing file or folder permissions can be used to impair defenses or alter access to sensitive data, enabling further malicious activity. It relies on Linux auditd telemetry capturing process execution details for these specific command names.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_file_or_folder_permissions.yml
author: Jakob Weinzettl, oscd.community, Huntrule Team
date: 2019-09-23
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1222.002
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|contains:
      - chmod
      - chown
  condition: selection
falsepositives:
  - User interacting with files permissions (normal/daily behaviour).
level: low
license: DRL-1.1
related:
  - id: 74c01ace-0152-4094-8ae2-6fd776dd43e5
    type: derived

What it detects

This rule identifies executions of chmod and chown by matching auditd records for EXECVE events containing those commands. Changing file or folder permissions can be used to impair defenses or alter access to sensitive data, enabling further malicious activity. It relies on Linux auditd telemetry capturing process execution details for these specific command names.

Known false positives

User interacting with files permissions (normal/daily behaviour).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.